Re: [PATCH 01/24] arm64: Fix lazy TCO clear when enabling user MTE

[Catalin Marinas]

On Sat, Nov 07, 2026 at 04:36:07PM +0100, Pierre-Clément Tosi wrote:
> On kernel entry from EL0 with HW KASAN inactive and user MTE disabled or
> in async mode, mte_disable_tco_entry() leaves PSTATE.TCO set to avoid an
> expensive write, as it assumes that EL1 tag checks are not needed.
> 
> However, if the thread is in the process of enabling sync or asymm MTE,
> set_mte_ctrl() updates SCTLR_EL1.TCF0 without clearing PSTATE.TCO! As a
> result, kernel uaccesses miss tag faults until the next context switch.

Nit: next context switch or another syscall. I think this makes it
clearer that the only potential missed tag accesses after the prctl() is
a signal frame write as we don't have other uaccesses.

> Clear TCO in set_mte_ctrl() immediately after setting the task's SCTLR.
> 
> Cc: Peter Collingbourne <peter@xxxxxxxxx>
> Cc: stable@xxxxxxxxxxxxxxx
> Fixes: 38ddf7dafaea ("arm64: mte: avoid clearing PSTATE.TCO on entry unless necessary")
> Signed-off-by: Pierre-Clément Tosi <ptosi@xxxxxxxxxx>

The patch is correct but I wonder whether we need a cc stable.

Reviewed-by: Catalin Marinas <catalin.marinas@xxxxxxx>