v3
2026-08-24
修复khugepaged跟踪点UAF · v3
khugepaged 三处修复：swap 值用 folio_pfn，解除 PTE 锁后和 folio_put/unlock 后避免再用 folio。
原始补丁链接
子 Patch（3）
1/3
mm: khugepaged: fix swap entry value to folio_pfn()
On 8/24/26 11:29, Vernon Yang wrote: > From: Vernon Yang yanglincheng@kylinos.cn > > When the swap entries found exceed max_ptes_swap, the loop is left via > break with folio still holding the xarr
2/3
mm: khugepaged: fix folio is used after pte_unmap_unlock()
[Re: [PATCH v3 2/3] mm: khugepaged: fix folio is used after pte_unmap_unlock()] On 8/24/26 11:29, Vernon Yang wrote: > From: Vernon Yang yanglincheng@kylinos.cn > > After the page table lock has dr
3/3
mm: khugepaged: fix folio is used after folio_put/unlock()
修复 khugepaged collapse_file() 中 new_folio 在 put/unlock 后仍被 tracepoint 使用导致 UAF 的问题；改为在释放前获取 folio_pfn()，使 trace_mm_khugepaged_collapse_file 记录 pfn 而非悬空指针。