v4
2026-07-17
ptdump 与 vmap 释放竞态修复 · v4
通过获取init_mm锁修复ptdump与vmap页表释放间的UAF竞争，涉及x86/arm64。
原始补丁链接
子 Patch（4）
1/4
mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF
[mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF] Currently there is a nasty race between ptdump and vmap when attempting to map a huge P4D, PUD or PMD entry: * ptdump walks kernel
2/4
x86/mm/pat: acquire init_mm write lock to avoid UAF
[x86/mm/pat: acquire init_mm write lock to avoid UAF] x86 implements page attribute modification using its Change Page Attributes (CPA) mechanism. This tracks properties of ranges such as cache mode
3/4
mm/ptdump: always stabilise against page table freeing using init_mm
[mm/ptdump: always stabilise against page table freeing using init_mm] Previous commits have established the invariant that kernel page table freeing is performed while an mmap read lock on init_mm is
4/4
arm64: remove redundant concurrent ptdump UAF mitigation
[arm64: remove redundant concurrent ptdump UAF mitigation] This partially reverts commit fa93b45fd397 (“arm64: Enable vmalloc-huge with ptdump”), retaining vmalloc-huge support but eliminating the now