[PATCH] mm/hmm: reject shadow-stack mappings

[Gregory Price (Meta)]

HMM can grant ordinary device write access to a userspace shadow stack.
On x86, pte_write() is true for a shadow-stack PTE, so a populated page
can be returned with HMM_PFN_WRITE without taking a CPU write fault.

Nouveau translates that flag into a writable GPU mapping.

Reject shadow-stack VMAs in hmm_vma_walk_test(). Use the existing
unsupported-range handling: a requested fault returns -EFAULT, while a
snapshot records HMM_PFN_ERROR.

Link: https://lore.kernel.org/linux-mm/20261111-mason-migrate-et-al-fixes-v1-10-3d2454362e8d@xxxxxxxxxx/
Fixes: 54007f818206 ("mm: Introduce VM_SHADOW_STACK for shadow stack memory")
Cc: stable@xxxxxxxxxxxxxxx
Cc: "Lorenzo Stoakes (ARM)" <ljs@xxxxxxxxxx>
Signed-off-by: Gregory Price (Meta) <gourry@xxxxxxxxxx>
---
 mm/hmm.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/mm/hmm.c b/mm/hmm.c
index 2f1e98c6b644..fa61ca59d927 100644
--- a/mm/hmm.c
+++ b/mm/hmm.c
@@ -596,6 +596,7 @@ static int hmm_vma_walk_test(unsigned long start, unsigned long end,
 	struct vm_area_struct *vma = walk->vma;
 
 	if (!(vma->vm_flags & (VM_IO | VM_PFNMAP)) &&
+	    !vma_test_single_mask(vma, VMA_SHADOW_STACK) &&
 	    vma->vm_flags & VM_READ)
 		return 0;
 
@@ -607,6 +608,8 @@ static int hmm_vma_walk_test(unsigned long start, unsigned long end,
 	 * allow write access either. HMM does not support architectures that
 	 * allow write without read.
 	 *
+	 * Devices must not gain ordinary write access to shadow stacks.
+	 *
 	 * If a fault is requested for an unsupported range then it is a hard
 	 * failure.
 	 */
-- 
2.56.0