[PATCH mm-hotfixes v6 0/5] mm: fix UAF caused by race between ptdump and vmap pgtable freeing

[Andrew Morton]

On Thu, 23 Jul 2026 16:26:46 -0700 Andrew Morton <akpm at linux-foundation.org> wrote:

> @@ -1250,7 +1251,11 @@ static int split_large_page(struct cpa_d
>  
>  	if (!debug_pagealloc_enabled())
>  		spin_unlock(&cpa_lock);
> +	if (cpa->init_mm_read_locked)
> +		mmap_read_unlock(&init_mm);
>  	ptdesc = pagetable_alloc(GFP_KERNEL, 0);
> +	if (cpa->init_mm_read_locked)
> +		mmap_read_lock(&init_mm);
>  	if (!debug_pagealloc_enabled())
>  		spin_lock(&cpa_lock);
>  	if (!ptdesc)

btw, this affects your later "x86/mm/pat: allocate split page tables as
kernel page tables".  Which I resolved thusly:

static int split_large_page(struct cpa_data *cpa, pte_t *kpte,
			    unsigned long address)
{
	pte_t *pte;

	if (!debug_pagealloc_enabled())
		spin_unlock(&cpa_lock);
	if (cpa->init_mm_read_locked)
		mmap_read_unlock(&init_mm);
	pte = pte_alloc_one_kernel(&init_mm);
	if (cpa->init_mm_read_locked)
		mmap_read_lock(&init_mm);
	if (!debug_pagealloc_enabled())
		spin_lock(&cpa_lock);
	if (!pte)
		return -ENOMEM;

	if (__split_large_page(cpa, kpte, address, pte))
		pte_free_kernel(&init_mm, pte);

	return 0;
}