[PATCH] ARM: mmu64: fix arch_remap_range permission-strip order

[PATCH] ARM: mmu64: fix arch_remap_range permission-strip order

[Stephano Cetola]

arch_remap_range() reassigned map_type via
arm_mmu_maybe_skip_permissions() before checking
maptype_is_compatible(map_type, MAP_CACHED) to decide whether to
flush. arm_mmu_maybe_skip_permissions() can turn MAP_CACHED into
MAP_CACHED_RWX, so the compatibility check ran against the
already-stripped value instead of the caller's original request. A
plain cached remap could silently skip the cache flush whenever
permission-skipping is active, because MAP_CACHED_RWX no longer
compares equal to MAP_CACHED.

Fix: evaluate the flush gate against the original map_type first,
then strip permissions afterward, right before the actual remap
call.

Found by code inspection while auditing map_type handling in this
area. No incorrect behavior has been observed in practice. This is
a correctness fix. It is not a report of an observed failure.

Fixes: 317aff483607 ("ARM: mmu: introduce new maptype_t type")
Signed-off-by: Stephano Cetola <stephano@cetola.net>
---
 arch/arm/cpu/mmu_64.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/arch/arm/cpu/mmu_64.c b/arch/arm/cpu/mmu_64.c
index 7f38473079..bf44cc7bcc 100644
--- a/arch/arm/cpu/mmu_64.c
+++ b/arch/arm/cpu/mmu_64.c
@@ -286,11 +286,16 @@ static void early_remap_range(uint64_t addr, size_t size, maptype_t map_type)
 
 int arch_remap_range(void *virt_addr, phys_addr_t phys_addr, size_t size, maptype_t map_type)
 {
-	map_type = arm_mmu_maybe_skip_permissions(map_type);
-
+	/*
+	 * Check against the original map_type: permission-stripping below
+	 * can turn MAP_CACHED into MAP_CACHED_RWX, which would look
+	 * incompatible.
+	 */
 	if (!maptype_is_compatible(map_type, MAP_CACHED))
 		flush_cacheable_pages(virt_addr, size);
 
+	map_type = arm_mmu_maybe_skip_permissions(map_type);
+
 	return __arch_remap_range((uint64_t)virt_addr, phys_addr, (uint64_t)size, map_type, true);
 }
 

---
base-commit: 9bc1a26592a59919d2ee8c60c273d87d3d9f2e81
change-id: 20260821-send-mmu-remap-order-ffa79f8f3847

Re: [PATCH] ARM: mmu64: fix arch_remap_range permission-strip order

[Ahmad Fatoum]

Hi,

On 8/22/26 4:07 PM, Stephano Cetola wrote:
> arch_remap_range() reassigned map_type via
> arm_mmu_maybe_skip_permissions() before checking
> maptype_is_compatible(map_type, MAP_CACHED) to decide whether to
> flush. arm_mmu_maybe_skip_permissions() can turn MAP_CACHED into
> MAP_CACHED_RWX, so the compatibility check ran against the
> already-stripped value instead of the caller's original request. A
> plain cached remap could silently skip the cache flush whenever
> permission-skipping is active, because MAP_CACHED_RWX no longer
> compares equal to MAP_CACHED.
> 
> Fix: evaluate the flush gate against the original map_type first,
> then strip permissions afterward, right before the actual remap
> call.
> 
> Found by code inspection while auditing map_type handling in this
> area. No incorrect behavior has been observed in practice. This is
> a correctness fix. It is not a report of an observed failure.
> 
> Fixes: 317aff483607 ("ARM: mmu: introduce new maptype_t type")
> Signed-off-by: Stephano Cetola <stephano@cetola.net>

This now aligns mmu_64.c with what mmu_32.c was doing:

Reviewed-by: Ahmad Fatoum <a.fatoum@pengutronix.de>

Cheers,
Ahmad

> ---
>  arch/arm/cpu/mmu_64.c | 9 +++++++--
>  1 file changed, 7 insertions(+), 2 deletions(-)
> 
> diff --git a/arch/arm/cpu/mmu_64.c b/arch/arm/cpu/mmu_64.c
> index 7f38473079..bf44cc7bcc 100644
> --- a/arch/arm/cpu/mmu_64.c
> +++ b/arch/arm/cpu/mmu_64.c
> @@ -286,11 +286,16 @@ static void early_remap_range(uint64_t addr, size_t size, maptype_t map_type)
>  
>  int arch_remap_range(void *virt_addr, phys_addr_t phys_addr, size_t size, maptype_t map_type)
>  {
> -	map_type = arm_mmu_maybe_skip_permissions(map_type);
> -
> +	/*
> +	 * Check against the original map_type: permission-stripping below
> +	 * can turn MAP_CACHED into MAP_CACHED_RWX, which would look
> +	 * incompatible.
> +	 */
>  	if (!maptype_is_compatible(map_type, MAP_CACHED))
>  		flush_cacheable_pages(virt_addr, size);
>  
> +	map_type = arm_mmu_maybe_skip_permissions(map_type);
> +
>  	return __arch_remap_range((uint64_t)virt_addr, phys_addr, (uint64_t)size, map_type, true);
>  }
>  
> 
> ---
> base-commit: 9bc1a26592a59919d2ee8c60c273d87d3d9f2e81
> change-id: 20260821-send-mmu-remap-order-ffa79f8f3847
> 
> 

-- 
Pengutronix e.K.                  |                             |
Steuerwalder Str. 21              | http://www.pengutronix.de/  |
31137 Hildesheim, Germany         | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686  | Fax:   +49-5121-206917-5555 |

Re: [PATCH] ARM: mmu64: fix arch_remap_range permission-strip order

[Sascha Hauer]

On Sat, 22 Aug 2026 07:07:31 -0700, Stephano Cetola wrote:
> arch_remap_range() reassigned map_type via
> arm_mmu_maybe_skip_permissions() before checking
> maptype_is_compatible(map_type, MAP_CACHED) to decide whether to
> flush. arm_mmu_maybe_skip_permissions() can turn MAP_CACHED into
> MAP_CACHED_RWX, so the compatibility check ran against the
> already-stripped value instead of the caller's original request. A
> plain cached remap could silently skip the cache flush whenever
> permission-skipping is active, because MAP_CACHED_RWX no longer
> compares equal to MAP_CACHED.
> 
> [...]

Applied, thanks!

[1/1] ARM: mmu64: fix arch_remap_range permission-strip order
      https://git.pengutronix.de/cgit/barebox/commit/?id=9594f6449bff (link may not be stable)

Best regards,
-- 
Sascha Hauer <s.hauer@pengutronix.de>