[PATCH v2 6/6] mm/mprotect: use huge_ptep_get() for hugetlb

[Muchun Song]

> On Jul 2, 2026, at 13:18, Dev Jain <dev.jain at arm.com> wrote:
> 
> 
> 
> On 02/07/26 10:43 am, Dev Jain wrote:
>> prot_none_hugetlb_entry() is the hugetlb callback for the early
>> mprotect(PROT_NONE) PFN permission walk on x86.
>> 
>> The callback passes the decoded PFN to pfn_modify_allowed(). For a
>> hugetlb callback, the pte pointer refers to a hugetlb entry. On
>> architectures where hugetlb entries need huge_ptep_get(), reading that
>> entry with ptep_get() can make the permission check use the wrong PFN.
>> 
>> Use huge_ptep_get() before decoding the hugetlb PFN.
>> 
>> Currently there is no path which can trigger a bug: huge_ptep_get() is a
>> simple ptep_get() for x86, and the prot_none walk occurs only for x86.
>> 
>> So no need to backport - use the correct helper anyways.
>> 
>> Fixes: 42e4089c7890 ("x86/speculation/l1tf: Disallow non privileged high MMIO PROT_NONE mappings")
>> Signed-off-by: Dev Jain <dev.jain at arm.com>
>> ---
> 
> @Muchun, I did not do the change you suggested: if we do #ifdef around
> the hugetlb callback, then for CONFIG_HUGETLB_PAGE=n, prot_none_hugetlb_entry()
> is defined but not used, giving compile error.
> 

Got it. Thanks for your explanation.