Re: [PATCH] ARM: mmu64: fix arch_remap_range permission-strip order

[Ahmad Fatoum <a.fatoum@pengutronix.de>]

Hi,

On 8/22/26 4:07 PM, Stephano Cetola wrote:
> arch_remap_range() reassigned map_type via
> arm_mmu_maybe_skip_permissions() before checking
> maptype_is_compatible(map_type, MAP_CACHED) to decide whether to
> flush. arm_mmu_maybe_skip_permissions() can turn MAP_CACHED into
> MAP_CACHED_RWX, so the compatibility check ran against the
> already-stripped value instead of the caller's original request. A
> plain cached remap could silently skip the cache flush whenever
> permission-skipping is active, because MAP_CACHED_RWX no longer
> compares equal to MAP_CACHED.
> 
> Fix: evaluate the flush gate against the original map_type first,
> then strip permissions afterward, right before the actual remap
> call.
> 
> Found by code inspection while auditing map_type handling in this
> area. No incorrect behavior has been observed in practice. This is
> a correctness fix. It is not a report of an observed failure.
> 
> Fixes: 317aff483607 ("ARM: mmu: introduce new maptype_t type")
> Signed-off-by: Stephano Cetola <stephano@cetola.net>

This now aligns mmu_64.c with what mmu_32.c was doing:

Reviewed-by: Ahmad Fatoum <a.fatoum@pengutronix.de>

Cheers,
Ahmad

> ---
>  arch/arm/cpu/mmu_64.c | 9 +++++++--
>  1 file changed, 7 insertions(+), 2 deletions(-)
> 
> diff --git a/arch/arm/cpu/mmu_64.c b/arch/arm/cpu/mmu_64.c
> index 7f38473079..bf44cc7bcc 100644
> --- a/arch/arm/cpu/mmu_64.c
> +++ b/arch/arm/cpu/mmu_64.c
> @@ -286,11 +286,16 @@ static void early_remap_range(uint64_t addr, size_t size, maptype_t map_type)
>  
>  int arch_remap_range(void *virt_addr, phys_addr_t phys_addr, size_t size, maptype_t map_type)
>  {
> -	map_type = arm_mmu_maybe_skip_permissions(map_type);
> -
> +	/*
> +	 * Check against the original map_type: permission-stripping below
> +	 * can turn MAP_CACHED into MAP_CACHED_RWX, which would look
> +	 * incompatible.
> +	 */
>  	if (!maptype_is_compatible(map_type, MAP_CACHED))
>  		flush_cacheable_pages(virt_addr, size);
>  
> +	map_type = arm_mmu_maybe_skip_permissions(map_type);
> +
>  	return __arch_remap_range((uint64_t)virt_addr, phys_addr, (uint64_t)size, map_type, true);
>  }
>  
> 
> ---
> base-commit: 9bc1a26592a59919d2ee8c60c273d87d3d9f2e81
> change-id: 20260821-send-mmu-remap-order-ffa79f8f3847
> 
> 

-- 
Pengutronix e.K.                  |                             |
Steuerwalder Str. 21              | http://www.pengutronix.de/  |
31137 Hildesheim, Germany         | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686  | Fax:   +49-5121-206917-5555 |