[PATCH mm-hotfixes v3 1/4] mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF

[David Hildenbrand (Arm)]

On 7/16/26 11:53, David Hildenbrand (Arm) wrote:
> 
>>  
>>  #define CREATE_TRACE_POINTS
>>  #include <trace/events/vmalloc.h>
>> @@ -158,10 +159,25 @@ static int vmap_try_huge_pmd(pmd_t *pmd, unsigned long addr, unsigned long end,
>>  	if (!IS_ALIGNED(phys_addr, PMD_SIZE))
>>  		return 0;
>>  
>> -	if (pmd_present(*pmd) && !pmd_free_pte_page(pmd, addr))
>> -		return 0;
>> +	if (!pmd_present(*pmd))
>> +		return pmd_set_huge(pmd, phys_addr, prot);
>>  
>> -	return pmd_set_huge(pmd, phys_addr, prot);
>> +	/*
>> +	 * Kernel page table walkers either walk ranges they own exclusively or
>> +	 * hold the mmap write lock on init_mm (ptdump being the motivating
>> +	 * case).
>> +	 *
>> +	 * Therefore, acquire the mmap read lock to prevent use-after-free when
>> +	 * freeing page tables.
>> +	 */
> 
> Can you spell out here why arm64 is special?
> 

Nevermind, I spotted #4.

Thanks!

Acked-by: David Hildenbrand (Arm) <david at kernel.org>

-- 
Cheers,

David