v2
2026-08-21
修复khugepaged跟踪点UAF · v2
khugepaged tracepoint 在 folio 释放后仍调用 folio_pfn()，改为直接传 pfn 消除 use-after-free。
原始补丁链接
子 Patch（3）
1/3
mm: khugepaged: fix swap entry value to folio_pfn()
From: Vernon Yang yanglincheng@kylinos.cn When the swap entries found exceed max_ptes_swap, the loop is left via break with folio still holding the xarray value that encodes the swap entry, not val
2/3
mm: khugepaged: fix folio is used after pte_unmap_unlock()
From: Vernon Yang yanglincheng@kylinos.cn After the page table lock has dropped, the folio can be freed concurrently. The trace_mm_khugepaged_scan_pmd() is left with a dangling folio pointer. So u
3/3
mm: khugepaged: fix folio is used after folio_put/unlock()
From: Vernon Yang yanglincheng@kylinos.cn On the rollback path, folio_put() has already dropped the last reference of new_folio. On the success path, new_folio is already unlocked and can be freed