Re: [PATCH 3/4] arm64: mte: Disregard the zero page explicitly for manipulating tags

[Catalin Marinas]

On Wed, Jun 03, 2026 at 06:09:53PM +0200, Ard Biesheuvel wrote:
> From: Ard Biesheuvel <ardb@xxxxxxxxxx>
> 
> The zero page is conceptually immutable, and will be moved into .rodata
> to prevent inadvertent corruption.
> 
> Prepare the MTE code for this, by ensuring that the zero page is never
> taken into account for tag manipulation, given that those actions will
> no longer be permitted on the read-only alias of .rodata in the linear
> map.
> 
> Signed-off-by: Ard Biesheuvel <ardb@xxxxxxxxxx>
> ---
>  arch/arm64/include/asm/mte.h | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/arch/arm64/include/asm/mte.h b/arch/arm64/include/asm/mte.h
> index 7f7b97e09996..093b34944aee 100644
> --- a/arch/arm64/include/asm/mte.h
> +++ b/arch/arm64/include/asm/mte.h
> @@ -80,6 +80,11 @@ static inline bool page_mte_tagged(struct page *page)
>   */
>  static inline bool try_page_mte_tagging(struct page *page)
>  {
> +	extern struct page *__zero_page;
> +
> +	if (page == __zero_page)
> +		return false;

Better as is_zero_page()

> +
>  	VM_WARN_ON_ONCE(folio_test_hugetlb(page_folio(page)));
>  
>  	if (!test_and_set_bit(PG_mte_lock, &page->flags.f))

Some form of this fix should have:

Fixes: f620d66af316 ("arm64: mte: Do not flag the zero page as PG_mte_tagged")
Cc: <stable@xxxxxxxxxxxxxxx> # 5.10.x

The current mainline assumption is that mapping the zero page in user
space is always mapped with pte_special() and we skip the MTE tag
zeroing (and PG flag setting). However, the above commit missed the KVM
kvm_s2_fault_map() -> sanitise_mte_tags() path and we don't have a form
of pte_special() for stage 2 mappings.

I'm more inclined to go with a specific test in the KVM path. It matches
the stage 1 where we skip the actual tagging. We could add a
VM_WARN_ONCE in try_page_mte_tagging() to trap future changes.

-------------8<-----------------------
diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c
index d089c107d9b7..445d6cf035c9 100644
--- a/arch/arm64/kvm/mmu.c
+++ b/arch/arm64/kvm/mmu.c
@@ -1479,6 +1479,11 @@ static void sanitise_mte_tags(struct kvm *kvm, kvm_pfn_t pfn,
 	if (!kvm_has_mte(kvm))
 		return;
 
+	if (is_zero_pfn(pfn)) {
+		WARN_ON_ONCE(nr_pages != 1);
+		return;
+	}
+
 	if (folio_test_hugetlb(folio)) {
 		/* Hugetlb has MTE flags set on head page only */
 		if (folio_try_hugetlb_mte_tagging(folio)) {

-- 
Catalin