v3
2026-07-15
ptdump 与 vmap 释放竞态修复 · v3
通过获取 init_mm 锁和 mmap 锁，修复 ptdump 与 vmap 页表释放之间的 UAF 竞争问题。
原始补丁链接
子 Patch（4）
1/4
mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF
On Tue, Jul 14, 2026 at 06:24:23PM +0100, Lorenzo Stoakes wrote: > Currently there is a nasty race between ptdump and vmap when attempting to > map a huge P4D, PMD or PUD entry: Nit: that’s a strange
2/4
x86/mm/pat: acquire mmap lock on page table free to avoid ptdump UAF
On Tue, Jul 14, 2026 at 10:29:51AM -0700, Dave Hansen wrote: > On 7/14/26 10:24, Lorenzo Stoakes wrote: > … > > Resolve the issue by acquiring the mmap read lock on init_mm which prevents > > a conc
3/4
mm/ptdump: always stabilise against page table freeing using init_mm
On Tue, Jul 14, 2026 at 06:24:25PM +0100, Lorenzo Stoakes wrote: > Previous commits have established the invariant that kernel page table > freeing is performed while an mmap read lock on init_mm is h
4/4
arm64: remove redundant concurrent ptdump UAF mitigation
回退 arm64 中 vmalloc-huge 与 ptdump 的并发 UAF 缓解措施，因核心层已修复该问题，同时移除不必要的 mmap 读锁获取。