From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id CA667C83F17 for ; Tue, 15 Jul 2025 19:32:22 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 4217D6B0088; Tue, 15 Jul 2025 15:32:22 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 3D25E6B008C; Tue, 15 Jul 2025 15:32:22 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 2E7CC6B0093; Tue, 15 Jul 2025 15:32:22 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0013.hostedemail.com [216.40.44.13]) by kanga.kvack.org (Postfix) with ESMTP id 1BB776B0088 for ; Tue, 15 Jul 2025 15:32:22 -0400 (EDT) Received: from smtpin19.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay03.hostedemail.com (Postfix) with ESMTP id 689BDB6A78 for ; Tue, 15 Jul 2025 19:32:21 +0000 (UTC) X-FDA: 83667495282.19.41DAC29 Received: from sea.source.kernel.org (sea.source.kernel.org [172.234.252.31]) by imf09.hostedemail.com (Postfix) with ESMTP id 9CD2A14000E for ; Tue, 15 Jul 2025 19:32:19 +0000 (UTC) Authentication-Results: imf09.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=qAgoElPY; spf=pass (imf09.hostedemail.com: domain of rppt@kernel.org designates 172.234.252.31 as permitted sender) smtp.mailfrom=rppt@kernel.org; dmarc=pass (policy=quarantine) header.from=kernel.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1752607939; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=WQueEkAnDA6R1aeylMobAW40Kh9UZf0h5yWnf71khTw=; b=ilOzKOei3CejaZym45EZsCX+AQOpbrqLZFEMr/6omjRXrdrURpKkx2nK/usNSvWLzZwS4p oGQSql5L7MjLFaErCmaaZeIT1S68jUPU0cDalQalixVh+bOaxWPt0Qch3mzRclBaxRB3wk YdV7LAnXKKJ1Q+v4Br5YM10rSk8TYcM= ARC-Authentication-Results: i=1; imf09.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=qAgoElPY; spf=pass (imf09.hostedemail.com: domain of rppt@kernel.org designates 172.234.252.31 as permitted sender) smtp.mailfrom=rppt@kernel.org; dmarc=pass (policy=quarantine) header.from=kernel.org ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1752607939; a=rsa-sha256; cv=none; b=k5+BG9fYO+knHw0GfmrHGt3trT2xHYGF2VrFspHJVfrN/f/x9iW9xbC8sYGh/X9euZVs43 NZJdk1wdqOaPZzVcDJELPdaUjj/b1ulGbrJDNwgBmfseLlrE3Oi933BsC/5nnguvweh3iB lpWScrwdRypMInW/3OhU6IHzbn1lL5Y= Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by sea.source.kernel.org (Postfix) with ESMTP id 534B245C56; Tue, 15 Jul 2025 19:32:18 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B3203C4CEE3; Tue, 15 Jul 2025 19:32:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1752607938; bh=7JrsV6AL8PRFa5ofeYSUfmdmXBy1shBRjk4m92xxzGg=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=qAgoElPYW8ku/W4uiillm+zBIkQVC1DfXKsmpe/BkbbizoKuJvKDtbvWGouW/FnOu Wd41/in0gB0RaRLtXGnyc/RFdVvR2YFTYfhltxR3b51+YFbabO11j+Eg2OGFgsmqbi BX9VaMdPrqhl9U7v9oDiw8SbZ4DqfvmEe22fzee73nmRQOIsbQJyYsGYExpqiZiLFP 4jSoLDhd61Grgd8TVX5ehXg4dYNiqOlkBwRjBY71/LNig3IXfJqql6cHF4uYTPSj42 XRDxgueNR7cE5ybbSfER+OnAt1msY2o6TLLtgtG6gdJg7Lb0VoEssPLOKa2jdtrpzd k9KCxSv7h/RnA== Date: Tue, 15 Jul 2025 22:32:12 +0300 From: Mike Rapoport To: Dan Moulding Cc: linux-mm@kvack.org, Peter Zijlstra Subject: Re: WARNING: Found insecure W+X mapping in v6.16-rc6 (Bisected) Message-ID: References: <20250715174325.8277-1-dan@danm.net> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20250715174325.8277-1-dan@danm.net> X-Rspam-User: X-Rspamd-Queue-Id: 9CD2A14000E X-Rspamd-Server: rspam06 X-Stat-Signature: duo6fshcukj8w7faykzfcnynhyziwok4 X-HE-Tag: 1752607939-529666 X-HE-Meta: U2FsdGVkX1/voAaEfU66xNxVAAt1ZrykJY6+DsOW7Z9E0QgtEAim+uMlTSCANGQlH24TVxauGpvb26Ayk1QOYkKMpd6/2ScbbkXqSv3jhkV5gSFgTfOtSrZ9L3okToTMm/WdsKslxcDiCP+UJq1B7dJe44nF/atcLc1SzwHBX0eiRmsWMvagxCd94UZQvf+howPsaG+GHMQoC5WuFeqmy30LMut2q8AbSvL9A+EKNRlcrFV7lbUzfkwoX339ophBkoGpj6v7O+UYsw7zPylCLBHMM8GHLFH0dzSdKumkTeF46KjXxgvzFYW3jloTICnG71x9fLps5kLlo83OM4Cout/zZR5WJ+lwH4FGCqG/Px00EN2eNxKY2b0ctuwQHHqp3xIrqz/5ZLQrJhocPxQeZmDVpZBMbu4RoJnmUXu/ne33Jauyxiq1rA+TGNYY4uSjqHu4mSgjZTY1W6W/lozHERcauSK9Rqc5bWWl+NvWEftPlY7saaIP+SeNBXzWeKh6PRY5pXsZ0SUwFmCS0j5r888lPYx9qUe2jgCWS0rFchLYB5OJrcUcG9czXr5deN59vW24Fon4/t5ktmtS1DuQ48ieP7TF6pw/2aUia/xHjdRaWiZpNsb0yfIjxJ++zUwTdlQjgoRQP+cft7FsgA/MYnugvkNbwPtO6TAdxQdlVvJWWe91Z4tqghRlRUjFAiWh120UkYCaAddg7FUoEkHDuHKnnOwqACCVHOJOFBBCQGY81y1n3ZSnargeQK2YspRG5UuLpTedlCE+iPJOe577hXpTjFVBH7Knl1elpnO5Db9aRdcUrOwDiZkjwdWGrjJ+Kv1zffsCBB31co5THjnvt6Az/hJR+YV+aSIQAMDEC/vob/jv5NITwXy1hci2ezYHRqiNfKX0h/AwWM3dU1wbdBstjrfScnqLUCJvAz4RkaNhz5y1gR51XQxIPy1SyLsjguLfa0h/qodv5QVCNwH SUMK6Nay NoTOPjs5vyw6v6pC9mvUZewVmtnIQp/zrY6qWmrIRRHcfHRoof7ENG08gEz0nQKrF54QlDfDMDUDJHpIhbLXz7cfkfi5+G5RZjKb398xfJPtCeBTtzVPGsR3bXkAjWv4u7if7z+AFqRmdIJPjnRBF2qaOXVRX0Xh1LYMoi0sNod/GlaUGLPZDxYYV293lzcQjZAKsw8ELcl/gtjGG0KwybN0ljSV5ArjMcwUVfNmCg/oxmjJOWv/Nx1cSom1KAcQTD2B8 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: Hi, On Tue, Jul 15, 2025 at 11:43:25AM -0600, Dan Moulding wrote: > Hello memory management folks, > > I just recently started testing the v6.16-rc6 kernel, and started > getting a new warning about insecure W+X mappings: > > [ 6.022847] ------------[ cut here ]------------ > [ 6.023020] x86/mm: Found insecure W+X mapping at address 0xffffffffc0247000 > [ 6.023200] WARNING: CPU: 5 PID: 1 at arch/x86/mm/dump_pagetables.c:246 note_page+0x6ec/0x790 ... > [ 6.031153] x86/mm: Checked W+X mappings: FAILED, 10 W+X pages found. > > I bisected it and git-bisect identified one of three possible commits > (I couldn't test these individually because builds at those points > fail to boot on my machine): > > There are only 'skip'ped commits left to test. > The first bad commit could be any of: > 0b0cae7119a0ec9449d7261b5e672a5fed765068 > 47410d839fcda6890cb82828f874f97710982f24 > a82b26451de126a5ae130361081986bc459afe9b I'd say this one is the culprit: a82b26451de1 ("x86/its: explicitly manage permissions for ITS pages") > We cannot bisect more! > > I then tried individually reverting each of these and found that if I > revert 47410d839fcd ("x86/Kconfig: only enable ROX cache in execmem > when STRICT_MODULE_RWX is set") on top of v6.16-rc6 then the warning > goes away. I looked at the change a little to understand why it might > be causing a problem, and I think it might be because my kernel > configuration does not enable loadable module support at all, so in my > configuration STRICT_MODULE_RWX isn't enabled and is probably > irrelevant given I don't build loadable modules. > > Please let me know if there are any additional details I can provide > or if I should run additional tests with debugging options enabled, etc. Can you please try this patch: diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig index 71019b3b54ea..f97e0a50e60a 100644 --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig @@ -89,7 +89,7 @@ config X86 select ARCH_HAS_DMA_OPS if GART_IOMMU || XEN select ARCH_HAS_EARLY_DEBUG if KGDB select ARCH_HAS_ELF_RANDOMIZE - select ARCH_HAS_EXECMEM_ROX if X86_64 && STRICT_MODULE_RWX + select ARCH_HAS_EXECMEM_ROX if X86_64 && (STRICT_KERNEL_RWX || STRICT_MODULE_RWX) select ARCH_HAS_FAST_MULTIPLIER select ARCH_HAS_FORTIFY_SOURCE select ARCH_HAS_GCOV_PROFILE_ALL > Cheers, > > -- Dan -- Sincerely yours, Mike.