Re: [PATCH 3/4] arm64: mte: Disregard the zero page explicitly for manipulating tags

[Ard Biesheuvel]

On Thu, 4 Jun 2026, at 11:19, Catalin Marinas wrote:
> On Wed, Jun 03, 2026 at 06:09:53PM +0200, Ard Biesheuvel wrote:
>> From: Ard Biesheuvel <ardb@xxxxxxxxxx>
>> 
>> The zero page is conceptually immutable, and will be moved into .rodata
>> to prevent inadvertent corruption.
>> 
>> Prepare the MTE code for this, by ensuring that the zero page is never
>> taken into account for tag manipulation, given that those actions will
>> no longer be permitted on the read-only alias of .rodata in the linear
>> map.
>> 
>> Signed-off-by: Ard Biesheuvel <ardb@xxxxxxxxxx>
>> ---
>>  arch/arm64/include/asm/mte.h | 5 +++++
>>  1 file changed, 5 insertions(+)
>> 
>> diff --git a/arch/arm64/include/asm/mte.h b/arch/arm64/include/asm/mte.h
>> index 7f7b97e09996..093b34944aee 100644
>> --- a/arch/arm64/include/asm/mte.h
>> +++ b/arch/arm64/include/asm/mte.h
>> @@ -80,6 +80,11 @@ static inline bool page_mte_tagged(struct page *page)
>>   */
>>  static inline bool try_page_mte_tagging(struct page *page)
>>  {
>> +	extern struct page *__zero_page;
>> +
>> +	if (page == __zero_page)
>> +		return false;
>
> Better as is_zero_page()
>

True, but I was concerned about #inclusion hell.

>> +
>>  	VM_WARN_ON_ONCE(folio_test_hugetlb(page_folio(page)));
>>  
>>  	if (!test_and_set_bit(PG_mte_lock, &page->flags.f))
>
> Some form of this fix should have:
>
> Fixes: f620d66af316 ("arm64: mte: Do not flag the zero page as PG_mte_tagged")
> Cc: <stable@xxxxxxxxxxxxxxx> # 5.10.x
>
> The current mainline assumption is that mapping the zero page in user
> space is always mapped with pte_special() and we skip the MTE tag
> zeroing (and PG flag setting). However, the above commit missed the KVM
> kvm_s2_fault_map() -> sanitise_mte_tags() path and we don't have a form
> of pte_special() for stage 2 mappings.
>
> I'm more inclined to go with a specific test in the KVM path. It matches
> the stage 1 where we skip the actual tagging. We could add a
> VM_WARN_ONCE in try_page_mte_tagging() to trap future changes.
>

Let's go with that - I'll turn this into a patch for v2


> -------------8<-----------------------
> diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c
> index d089c107d9b7..445d6cf035c9 100644
> --- a/arch/arm64/kvm/mmu.c
> +++ b/arch/arm64/kvm/mmu.c
> @@ -1479,6 +1479,11 @@ static void sanitise_mte_tags(struct kvm *kvm, 
> kvm_pfn_t pfn,
>  	if (!kvm_has_mte(kvm))
>  		return;
> 
> +	if (is_zero_pfn(pfn)) {
> +		WARN_ON_ONCE(nr_pages != 1);
> +		return;
> +	}
> +
>  	if (folio_test_hugetlb(folio)) {
>  		/* Hugetlb has MTE flags set on head page only */
>  		if (folio_try_hugetlb_mte_tagging(folio)) {
>
> -- 
> Catalin