[PATCH mm-hotfixes v6 0/5] mm: fix UAF caused by race between ptdump and vmap pgtable freeing

[Lorenzo Stoakes (ARM)]

On Thu, Jul 23, 2026 at 04:32:33PM -0700, Andrew Morton wrote:
> On Thu, 23 Jul 2026 16:26:46 -0700 Andrew Morton <akpm at linux-foundation.org> wrote:
>
> > @@ -1250,7 +1251,11 @@ static int split_large_page(struct cpa_d
> >
> >  	if (!debug_pagealloc_enabled())
> >  		spin_unlock(&cpa_lock);
> > +	if (cpa->init_mm_read_locked)
> > +		mmap_read_unlock(&init_mm);
> >  	ptdesc = pagetable_alloc(GFP_KERNEL, 0);
> > +	if (cpa->init_mm_read_locked)
> > +		mmap_read_lock(&init_mm);
> >  	if (!debug_pagealloc_enabled())
> >  		spin_lock(&cpa_lock);
> >  	if (!ptdesc)
>
> btw, this affects your later "x86/mm/pat: allocate split page tables as
> kernel page tables".  Which I resolved thusly:
>
> static int split_large_page(struct cpa_data *cpa, pte_t *kpte,
> 			    unsigned long address)
> {
> 	pte_t *pte;
>
> 	if (!debug_pagealloc_enabled())
> 		spin_unlock(&cpa_lock);
> 	if (cpa->init_mm_read_locked)
> 		mmap_read_unlock(&init_mm);
> 	pte = pte_alloc_one_kernel(&init_mm);
> 	if (cpa->init_mm_read_locked)
> 		mmap_read_lock(&init_mm);
> 	if (!debug_pagealloc_enabled())
> 		spin_lock(&cpa_lock);
> 	if (!pte)
> 		return -ENOMEM;
>
> 	if (__split_large_page(cpa, kpte, address, pte))
> 		pte_free_kernel(&init_mm, pte);
>
> 	return 0;
> }
>
>

Thanks that's correct!

Cheers, Lorenzo