Thread (6 messages) 6 messages, 4 authors, 2025-10-03

Re: [PATCH] arm64: mte: Do not flag the zero page as PG_mte_tagged

From: David Hildenbrand <hidden>
Date: 2025-09-24 12:41:46
Also in: linux-mm

On 24.09.25 14:31, Catalin Marinas wrote:
Commit 68d54ceeec0e ("arm64: mte: Allow PTRACE_PEEKMTETAGS access to the
zero page") attempted to fix ptrace() reading of tags from the zero page
by marking it as PG_mte_tagged during cpu_enable_mte(). The same commit
also changed the ptrace() tag access permission check to the VM_MTE vma
flag while turning the page flag test into a WARN_ON_ONCE().

Attempting to set the PG_mte_tagged flag early with
CONFIG_DEFERRED_STRUCT_PAGE_INIT enabled may either hang (after commit
d77e59a8fccd "arm64: mte: Lock a page for MTE tag initialisation") or
have the flags cleared later during page_alloc_init_late(). In addition,
pages_identical() -> memcmp_pages() will reject any comparison with the
zero page as it is marked as tagged.

Partially revert the above commit to avoid setting PG_mte_tagged on the
zero page. Update the __access_remote_tags() warning on untagged pages
to ignore the zero page since it is known to have the tags initialised.

Note that all user mapping of the zero page are marked as pte_special().
The arm64 set_pte_at() will not call mte_sync_tags() on such pages, so
PG_mte_tagged will remain cleared.

Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Fixes: 68d54ceeec0e ("arm64: mte: Allow PTRACE_PEEKMTETAGS access to the zero page")
Reported-by: Gergely Kovacs <redacted>
Cc: <redacted> # 5.10.x
Cc: Will Deacon <will@kernel.org>
Cc: David Hildenbrand <redacted>
Cc: Lance Yang <lance.yang@linux.dev>
---

For reference, discussion on page merging here:

https://lore.kernel.org/r/aNKJ5glToE4hMhWA@arm.com (local)

The deferred struct page init problem was reported by Gergely offline.

Given that we've had this bug for over four years and it was only
recently noticed, I think we should merge it at -rc1, give it a bit more
time in -next in case it breaks anything (not likely but you never know,
MTE interaction with the mm code is always surprising ;)).
Agreed :)

LGTM

Reviewed-by: David Hildenbrand <redacted>

-- 
Cheers

David / dhildenb

Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help