[PATCH] ARM: mmu64: fix arch_remap_range permission-strip order

arch_remap_range() reassigned map_type via
arm_mmu_maybe_skip_permissions() before checking
maptype_is_compatible(map_type, MAP_CACHED) to decide whether to
flush. arm_mmu_maybe_skip_permissions() can turn MAP_CACHED into
MAP_CACHED_RWX, so the compatibility check ran against the
already-stripped value instead of the caller's original request. A
plain cached remap could silently skip the cache flush whenever
permission-skipping is active, because MAP_CACHED_RWX no longer
compares equal to MAP_CACHED.

Fix: evaluate the flush gate against the original map_type first,
then strip permissions afterward, right before the actual remap
call.

Found by code inspection while auditing map_type handling in this
area. No incorrect behavior has been observed in practice. This is
a correctness fix. It is not a report of an observed failure.

Fixes: 317aff483607 ("ARM: mmu: introduce new maptype_t type")
Signed-off-by: Stephano Cetola <[email protected]>
---
 arch/arm/cpu/mmu_64.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/arch/arm/cpu/mmu_64.c b/arch/arm/cpu/mmu_64.c
index 7f38473079..bf44cc7bcc 100644
--- a/arch/arm/cpu/mmu_64.c
+++ b/arch/arm/cpu/mmu_64.c
@@ -286,11 +286,16 @@ static void early_remap_range(uint64_t addr, size_t size, maptype_t map_type)
 
 int arch_remap_range(void *virt_addr, phys_addr_t phys_addr, size_t size, maptype_t map_type)
 {
-	map_type = arm_mmu_maybe_skip_permissions(map_type);
-
+	/*
+	 * Check against the original map_type: permission-stripping below
+	 * can turn MAP_CACHED into MAP_CACHED_RWX, which would look
+	 * incompatible.
+	 */
 	if (!maptype_is_compatible(map_type, MAP_CACHED))
 		flush_cacheable_pages(virt_addr, size);
 
+	map_type = arm_mmu_maybe_skip_permissions(map_type);
+
 	return __arch_remap_range((uint64_t)virt_addr, phys_addr, (uint64_t)size, map_type, true);
 }
 

---
base-commit: 9bc1a26592a59919d2ee8c60c273d87d3d9f2e81
change-id: 20260821-send-mmu-remap-order-ffa79f8f3847