v5
2026-07-18
ptdump 与 vmap 释放竞态修复 · v5
讨论通过获取init_mm锁来修复ptdump与vmap页表释放间的UAF竞争问题的v5补丁系列。
原始补丁链接
子 Patch（5）
1/5
mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF
Currently there is a nasty race between ptdump and vmap when attempting to map a huge P4D, PUD or PMD entry: * ptdump walks kernel page table ranges it doesn’t own. * When vmap maps ranges it tries
2/5
x86/mm/pat: acquire init_mm write lock on collapse to avoid UAF
[x86/mm/pat: acquire init_mm write lock on collapse to avoid UAF] x86 implements page attribute modification using its Change Page Attributes (CPA) mechanism. This tracks properties of ranges such as
3/5
x86/mm/pat: acquire init_mm read lock on attribute change to avoid UAF
A previous commit protected us against races between ptdump and CPA collapse, however one still exists between attribute changes and collapse as reported by Denis V. Lunev (linked). When an attribute
4/5
mm/ptdump: always stabilise against page table freeing using init_mm
Previous commits have established the invariant that kernel page table freeing is performed while an mmap read lock on init_mm is held, which fixes races between ptdump and kernel page table freeing o
5/5
arm64: remove redundant concurrent ptdump UAF mitigation
This partially reverts commit fa93b45fd397 (“arm64: Enable vmalloc-huge with ptdump”), retaining vmalloc-huge support but eliminating the now redundant mitigation against a race between huge vmap page