v5
2026-09-09
修复khugepaged跟踪点UAF · v5
修复khugepaged tracepoint在folio失效/换出后调用folio_pfn()的UAF，改为tracepoint直接传入pfn。
原始补丁链接
子 Patch（3）
1/3
mm: khugepaged: fix swap entry value to folio_pfn()
From: Vernon Yang yanglincheng@kylinos.cn When the swap entries found exceed max_ptes_swap, the loop is left via break with folio still holding the xarray value that encodes the swap entry, not val
2/3
mm: khugepaged: fix folio is used after pte_unmap_unlock()
From: Vernon Yang yanglincheng@kylinos.cn After the page table lock has dropped, the folio can be freed concurrently. The trace_mm_khugepaged_scan_pmd() is left with a dangling folio pointer. So u
3/3
mm: khugepaged: fix folio is used after folio_put/unlock()
From: Vernon Yang yanglincheng@kylinos.cn On the rollback path, folio_put() has already dropped the last reference of new_folio. On the success path, new_folio is already unlocked and can be freed