[PATCH v2 2/4] KVM: arm64: Clear the whole hugetlb folio when storing MTE tags

[Fuad Tabba]

On Thu, 29 Oct 2026 at 22:02, Catalin Marinas <catalin.marinas at arm.com> wrote:
[...]
> > +                      * tags. A hugetlb folio is marked tagged as a whole,
> > +                      * so its first tagging clears every page.
> >                        */
> > -                     if (folio_test_hugetlb(folio))
> > -                             folio_try_hugetlb_mte_tagging(folio);
> > -                     else
> > +                     if (!folio_test_hugetlb(folio))
> >                               try_page_mte_tagging(page);
> > +                     else if (folio_try_hugetlb_mte_tagging(folio))
> > +                             for (i = 0; i < folio_nr_pages(folio); i++)
> > +                                     mte_clear_page_tags(page_address(folio_page(folio, i)));
>
> I guess we could have skipped the actual page we are going to copy into
> but not worth it.
>
> Reviewed-by: Catalin Marinas <catalin.marinas at arm.com>
>
> >                       num_tags = mte_copy_tags_from_user(maddr, tags,
> >                                                       MTE_GRANULES_PER_PAGE);
>
> Something Claude spotted and unrelated to your patch. A malicious VMM
> using memfd (not guest_memfd) and MAP_SHARED could construct some
> mapping so that the VM slot is !PROT_MTE while the same page is mapped
> in the VMM with PROT_MTE. try_page_mte_tagging() (or the folio one)
> above set PG_mte_lock but a subsequent fault on the uaccess to VMM
> memory will attempt to zero the tags and wait (forever) on the page
> lock. Not tested to prove it.
>
> If you get bored and want to fix it, I guess a copy_from_user() into a
> local buffer and then setting the page tags.

Thanks Catalin. I'll look into this and send a fix.

Cheers,
/fuad