[PATCH] x86/mm/pat: fix effective RW computation in lookup_address_in_pgd_attr()

[Mike Rapoport (Microsoft)]

lookup_address_in_pgd_attr() accumulates the effective NX and RW bits of
the walked page table levels so that verify_rwx() can detect mappings that
are both writable and executable.

The RW bits are folded into a bool with

	*rw &= pXd_flags(*pXd) & _PAGE_RW;

but _PAGE_RW is bit 1 while *rw only ever holds 0 or 1, so the AND is
always 0.  *rw becomes false at the first level walked, regardless of the
actual permissions, and verify_rwx() treats every mapping as non-writable
and never reports a W^X violation.

Accumulate NX and RW in unsigned long locals in their native bit positions
and store the result into the bool outputs once.

Fixes: ceb647b4b529 ("x86/pat: Introduce lookup_address_in_pgd_attr()")
Assisted-by: Copilot:claude-opus-4.8
Signed-off-by: Mike Rapoport (Microsoft) <rppt@xxxxxxxxxx>
---
 arch/x86/mm/pat/set_memory.c | 58 ++++++++++++++++++++++++++------------------
 1 file changed, 35 insertions(+), 23 deletions(-)

diff --git a/arch/x86/mm/pat/set_memory.c b/arch/x86/mm/pat/set_memory.c
index d023a40a1e03..05de76887fd3 100644
--- a/arch/x86/mm/pat/set_memory.c
+++ b/arch/x86/mm/pat/set_memory.c
@@ -716,57 +716,69 @@ static inline pgprot_t verify_rwx(pgprot_t old, pgprot_t new, unsigned long star
  * page table levels.
  */
 pte_t *lookup_address_in_pgd_attr(pgd_t *pgd, unsigned long address,
-				  unsigned int *level, bool *nx, bool *rw)
+				  unsigned int *level,
+				  bool *ret_nx, bool *ret_rw)
 {
+	unsigned long rw = _PAGE_RW;
+	unsigned long nx = 0;
+	pte_t *pte = NULL;
 	p4d_t *p4d;
 	pud_t *pud;
 	pmd_t *pmd;
 
 	*level = PG_LEVEL_256T;
-	*nx = false;
-	*rw = true;
-
 	if (pgd_none(*pgd))
-		return NULL;
+		goto out;
 
 	*level = PG_LEVEL_512G;
-	*nx |= pgd_flags(*pgd) & _PAGE_NX;
-	*rw &= pgd_flags(*pgd) & _PAGE_RW;
+	nx |= pgd_flags(*pgd) & _PAGE_NX;
+	rw &= pgd_flags(*pgd) & _PAGE_RW;
 
 	p4d = p4d_offset(pgd, address);
 	if (p4d_none(*p4d))
-		return NULL;
+		goto out;
 
-	if (p4d_leaf(*p4d) || !p4d_present(*p4d))
-		return (pte_t *)p4d;
+	if (p4d_leaf(*p4d) || !p4d_present(*p4d)) {
+		pte = (pte_t *)p4d;
+		goto out;
+	}
 
 	*level = PG_LEVEL_1G;
-	*nx |= p4d_flags(*p4d) & _PAGE_NX;
-	*rw &= p4d_flags(*p4d) & _PAGE_RW;
+	nx |= p4d_flags(*p4d) & _PAGE_NX;
+	rw &= p4d_flags(*p4d) & _PAGE_RW;
 
 	pud = pud_offset(p4d, address);
 	if (pud_none(*pud))
-		return NULL;
+		goto out;
 
-	if (pud_leaf(*pud) || !pud_present(*pud))
-		return (pte_t *)pud;
+	if (pud_leaf(*pud) || !pud_present(*pud)) {
+		pte = (pte_t *)pud;
+		goto out;
+	}
 
 	*level = PG_LEVEL_2M;
-	*nx |= pud_flags(*pud) & _PAGE_NX;
-	*rw &= pud_flags(*pud) & _PAGE_RW;
+	nx |= pud_flags(*pud) & _PAGE_NX;
+	rw &= pud_flags(*pud) & _PAGE_RW;
 
 	pmd = pmd_offset(pud, address);
 	if (pmd_none(*pmd))
-		return NULL;
+		goto out;
 
-	if (pmd_leaf(*pmd) || !pmd_present(*pmd))
-		return (pte_t *)pmd;
+	if (pmd_leaf(*pmd) || !pmd_present(*pmd)) {
+		pte = (pte_t *)pmd;
+		goto out;
+	}
 
 	*level = PG_LEVEL_4K;
-	*nx |= pmd_flags(*pmd) & _PAGE_NX;
-	*rw &= pmd_flags(*pmd) & _PAGE_RW;
+	nx |= pmd_flags(*pmd) & _PAGE_NX;
+	rw &= pmd_flags(*pmd) & _PAGE_RW;
+	pte = pte_offset_kernel(pmd, address);
+
+out:
+	*ret_nx = !!nx;
+	*ret_rw = !!rw;
 
-	return pte_offset_kernel(pmd, address);
+	return pte;
 }
 
 /*

---
base-commit: a13c140cc289c0b7b3770bce5b3ad42ab35074aa
change-id: 20260716-verify-rwx-fix-3b0bd3e51244

--
Sincerely yours,
Mike.