v4
2026-08-28
修复khugepaged跟踪点UAF · v4
修复 khugepaged tracepoint 在 folio 释放或 pte_unmap 后仍调 folio_pfn() 导致 UAF/错误 pfn，改为传入 pfn。
原始补丁链接
子 Patch（3）
1/3
mm: khugepaged: fix swap entry value to folio_pfn()
From: Vernon Yang yanglincheng@kylinos.cn When the swap entries found exceed max_ptes_swap, the loop is left via break with folio still holding the xarray value that encodes the swap entry, not val
2/3
mm: khugepaged: fix folio is used after pte_unmap_unlock()
From: Vernon Yang yanglincheng@kylinos.cn After the page table lock has dropped, the folio can be freed concurrently. The trace_mm_khugepaged_scan_pmd() is left with a dangling folio pointer. So u
3/3
mm: khugepaged: fix folio is used after folio_put/unlock()
From: Vernon Yang yanglincheng@kylinos.cn On the rollback path, folio_put() has already dropped the last reference of new_folio. On the success path, new_folio is already unlocked and can be freed