From: David Carlier <devnexen@gmail.com>
To: syzbot+fd95a72470f5a44e464c@syzkaller.appspotmail.com
Cc: linux-mm@kvack.org, akpm@linux-foundation.org,
linux-kernel@vger.kernel.org, David Carlier <devnexen@gmail.com>
Subject: Re: [syzbot] [mm?] KASAN: use-after-free Read in ptdump_pte_entry (2)
Date: Wed, 17 Jun 2026 13:06:29 +0100 [thread overview]
Message-ID: <20260617120629.160448-1-devnexen@gmail.com> (raw)
In-Reply-To: <6a287988.39669fcc.33b062.00a0.GAE@google.com>
ptdump walks kernel page tables it does not own. While the walk runs, vmalloc
can promote a range to a huge PMD (vmap_try_huge_pmd), which collapses the
existing PTE table and frees it via pmd_free_pte_page() with no init_mm mmap
lock on x86/riscv/powerpc. So ptdump dereferences a just-freed PTE page, hence
the UAF in ptdump_pte_entry().
The race is pre-existing; 5ba2f0a15564 only widened the window by deferring
the free.
Fix posted (v5): defer the kernel page table free by an RCU grace period and
walk ptdump under rcu_read_lock().
https://lore.kernel.org/linux-mm/20260617115342.156775-1-devnexen@gmail.com/
prev parent reply other threads:[~2026-06-17 12:06 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-06-09 20:37 [syzbot] [mm?] KASAN: use-after-free Read in ptdump_pte_entry (2) syzbot
2026-06-17 12:06 ` David Carlier [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260617120629.160448-1-devnexen@gmail.com \
--to=devnexen@gmail.com \
--cc=akpm@linux-foundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=syzbot+fd95a72470f5a44e464c@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.