[PATCH] mm: pgtable: free kernel page tables via RCU to fix ptdump UAF

[Dev Jain]

On 01/07/26 11:27 am, David CARLIER wrote:
> Hi Dev,
> 
> Yes, the RCU deferral covers arm64 too, so the static key and the
> mmap_lock in pud_free_pmd_page()/pmd_free_pte_page() are now
> redundant. Keep the arch_vmap_*_supported() changes though.

Sorry I should have mentioned in my previous email that I had a comment
below, on the code :) could you please see below.

[--- snip ---]


>>> diff --git a/mm/ptdump.c b/mm/ptdump.c
>>> index 973020000096..50cd96a33dfd 100644
>>> --- a/mm/ptdump.c
>>> +++ b/mm/ptdump.c
>>> @@ -178,11 +178,13 @@ void ptdump_walk_pgd(struct ptdump_state *st, struct mm_struct *mm, pgd_t *pgd)
>>>
>>>       get_online_mems();
>>>       mmap_write_lock(mm);
>>
>> mmap write lock is not required anymore no?

^
>>
>>
>>> +     rcu_read_lock();
>>
>> Is there a possibility of RCU stall here? For example a system with
>> lots of physical memory will have a huge linear map.

^


>>
>>>       while (range->start != range->end) {
>>>               walk_page_range_debug(mm, range->start, range->end,
>>>                                     &ptdump_ops, pgd, st);
>>>               range++;
>>>       }
>>> +     rcu_read_unlock();
>>>       mmap_write_unlock(mm);
>>>       put_online_mems();
>>>
>>