Re: [PATCH mm-hotfixes v4 2/4] x86/mm/pat: acquire init_mm write lock to avoid UAF

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The patch adds `mmap_write_lock(&init_mm)` to prevent `ptdump` from encountering a Use-After-Free when `cpa_collapse_large_pages` frees kernel page tables. However, it fails to protect lockless kernel page table walkers like `vmalloc_to_page` and `lookup_address`, leaving them vulnerable to the exact same UAF.
--

--- Patch [2]: [PATCH mm-hotfixes v4 2/4] x86/mm/pat: acquire init_mm write lock to avoid UAF ---
commit 5b395a03ec3db496bc431613dd4a4fe93dcd87d9
Author: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Subject: x86/mm/pat: acquire init_mm write lock to avoid UAF

This patch adds an mmap write lock acquisition around kernel page table
collapsing in the x86 PAT code. It aims to prevent use-after-free issues
when concurrent walkers like ptdump traverse page tables while they are
being freed.

> diff --git a/arch/x86/mm/pat/set_memory.c b/arch/x86/mm/pat/set_memory.c
> index d023a40a1e034..d1e63f7d267ff 100644
> --- a/arch/x86/mm/pat/set_memory.c
> +++ b/arch/x86/mm/pat/set_memory.c

[ ... ]

> @@ -442,6 +443,18 @@ static void cpa_collapse_large_pages(struct cpa_data *cpa)
>  	}
>  }
>  
> +static void cpa_collapse_large_pages(struct cpa_data *cpa)
> +{
> +	/*
> +	 * Take the mmap write lock on init_mm to:
> +	 * - Avoid a use-after-free if raced by ptdump (which takes its own
> +	 *   write lock on init_mm).
> +	 * - Serialise concurrent CPA walkers.
> +	 */
> +	scoped_guard(mmap_write_lock, &init_mm)
> +		__cpa_collapse_large_pages(cpa);

[Severity: High]
This is a pre-existing issue, but does taking the mmap write lock on init_mm
protect against lockless kernel page table walkers?

While this prevents a race with ptdump, functions like vmalloc_to_page() or
lookup_address() can still walk the kernel page tables without holding the
init_mm mmap lock.

If a lockless walker reaches the PMD level just as
__cpa_collapse_large_pages() collapses the huge page and calls
pagetable_free(), couldn't the walker encounter a use-after-free when it
calls pte_offset_kernel() on the freed page table?

For example, a concurrent call to vmalloc_to_page() could see:

CPU1
__cpa_collapse_large_pages()
    pagetable_free(ptdesc); /* freed immediately, no RCU grace period */

CPU2
vmalloc_to_page()
    ptep = pte_offset_kernel(pmd, addr); /* UAF on freed page table */
    pte = ptep_get(ptep);

Does this mean the page tables still need to be freed via RCU to ensure
these lockless walkers don't dereference freed memory?

> +}
> +
>  static void cpa_flush(struct cpa_data *cpa, int cache)
>  {
>  	unsigned int i;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260716-series-vmap-race-fix-v4-0-8c108c4317df@kernel.org?part=2