[PATCH 2/3] arm64: gcs: Allow PAGE_NONE mappings for NUMA balancing

[Catalin Marinas]

vm_get_page_prot() short-circuits the protection_map[] lookup for a
VM_SHADOW_STACK mapping since its permissions are special. However, it
also ignores PAGE_NONE mappings used for NUMA balancing by creating an
accessible PTE.

Special-case the VM_NONE permission to create an invalid PTE even if it
is a GCS mapping.

Signed-off-by: Catalin Marinas <catalin.marinas at arm.com>
Fixes: 6497b66ba694 ("arm64/mm: Map pages for guarded control stack")
Cc: <stable at vger.kernel.org>
Cc: Mark Brown <broonie at kernel.org>
Cc: Will Deacon <will at kernel.org>
Cc: David Hildenbrand <david at kernel.org>
---
 arch/arm64/mm/mmap.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/arch/arm64/mm/mmap.c b/arch/arm64/mm/mmap.c
index 2e404441063b..f8993e3fa5d1 100644
--- a/arch/arm64/mm/mmap.c
+++ b/arch/arm64/mm/mmap.c
@@ -87,7 +87,15 @@ pgprot_t vm_get_page_prot(vm_flags_t vm_flags)
 
 	/* Short circuit GCS to avoid bloating the table. */
 	if (system_supports_gcs() && (vm_flags & VM_SHADOW_STACK)) {
-		prot = pgprot_val(PAGE_GCS_RO);
+		/*
+		 * Allow PAGE_NONE for NUMA balancing, otherwise use
+		 * PAGE_GCS_RO. The permission will be made writeable
+		 * (PAGE_GCS) on a GCS fault.
+		 */
+		if (vm_flags & (VM_READ | VM_WRITE))
+			prot = pgprot_val(PAGE_GCS_RO);
+		else
+			prot = pgprot_val(protection_map[VM_NONE]);
 	} else {
 		prot = pgprot_val(protection_map[vm_flags &
 				   (VM_READ|VM_WRITE|VM_EXEC|VM_SHARED)]);