v6
2026-07-24
ptdump 与 vmap 释放竞态修复 · v6
通过获取init_mm锁防止ptdump与vmap页表释放间的UAF竞争，并移除arm64冗余缓解措施。
原始补丁链接
子 Patch（5）
1/5
mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF
[mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF] Currently there is a nasty race between ptdump and vmap when attempting to map a huge P4D, PUD or PMD entry: * ptdump walks kernel
2/5
x86/mm/pat: acquire init_mm write lock on collapse to avoid UAF
[x86/mm/pat: acquire init_mm write lock on collapse to avoid UAF] x86 implements page attribute modification using its Change Page Attributes (CPA) mechanism. This tracks properties of ranges such as
3/5
x86/mm/pat: acquire init_mm read lock on attribute change to avoid UAF
[x86/mm/pat: acquire init_mm read lock on attribute change to avoid UAF] A previous commit protected us against races between ptdump and CPA collapse, however one still exists between attribute change
4/5
mm/ptdump: always stabilise against page table freeing using init_mm
[mm/ptdump: always stabilise against page table freeing using init_mm] Previous commits have established the invariant that kernel page table freeing is performed while an mmap read lock on init_mm is
5/5
arm64: remove redundant concurrent ptdump UAF mitigation
[arm64: remove redundant concurrent ptdump UAF mitigation] This partially reverts commit fa93b45fd397 (“arm64: Enable vmalloc-huge with ptdump”), retaining vmalloc-huge support but eliminating the now