Re: [PATCH mm-hotfixes v6 2/5] x86/mm/pat: acquire init_mm write lock on collapse to avoid UAF

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Incomplete Fix / Use-After-Free: Lockless kernel page table walkers (like `vmalloc_to_page()`) are still vulnerable to UAF when kernel page tables are freed.
--

--- Patch [2]: [PATCH mm-hotfixes v6 2/5] x86/mm/pat: acquire init_mm write lock on collapse to avoid UAF ---
commit 5ded4e5b38c3bfea3e52e559a3009697ac580593
Author: Lorenzo Stoakes (ARM) <ljs@kernel.org>

x86/mm/pat: acquire init_mm write lock on collapse to avoid UAF
    
This commit attempts to fix a use-after-free issue when collapsing
page tables by taking the mmap write lock on init_mm during the
CPA collapse operation. It aims to serialize against ptdump and
other concurrent CPA walkers.

> diff --git a/arch/x86/mm/pat/set_memory.c b/arch/x86/mm/pat/set_memory.c
> index d023a40a1e034..d1e63f7d267ff 100644
> --- a/arch/x86/mm/pat/set_memory.c
> +++ b/arch/x86/mm/pat/set_memory.c

[ ... ]

> @@ -442,6 +443,18 @@ static void cpa_collapse_large_pages(struct cpa_data *cpa)
>  	}
>  }
>  
> +static void cpa_collapse_large_pages(struct cpa_data *cpa)
> +{
> +	/*
> +	 * Take the mmap write lock on init_mm to:
> +	 * - Avoid a use-after-free if raced by ptdump (which takes its own
> +	 *   write lock on init_mm).
> +	 * - Serialise concurrent CPA walkers.
> +	 */
> +	scoped_guard(mmap_write_lock, &init_mm)
> +		__cpa_collapse_large_pages(cpa);
> +}

[Severity: High]
This is a pre-existing issue, but does this fix leave lockless kernel page
table walkers unprotected?

While taking the init_mm mmap write lock serializes against ptdump,
functions like vmalloc_to_page() in mm/vmalloc.c perform lockless walks
over the kernel page tables without acquiring the init_mm mmap read lock:

mm/vmalloc.c:vmalloc_to_page() {
    ...
    pmd = pmd_offset(pud, addr);
    if (pmd_none(*pmd))
        return NULL;
    if (pmd_leaf(*pmd))
        return pmd_page(*pmd) + ((addr & ~PMD_MASK) >> PAGE_SHIFT);
    if (WARN_ON_ONCE(pmd_bad(*pmd)))
        return NULL;

    ptep = pte_offset_kernel(pmd, addr);
    ...
}

If a thread executing vmalloc_to_page() checks pmd_leaf() and is preempted,
and concurrently set_memory_rox() calls cpa_collapse_large_pages(), the
PMD could be collapsed and the old PTE page freed. 

When the first thread resumes, could it dereference the freed PTE page 
causing a use-after-free, or read the new leaf PMD and incorrectly treat 
it as a PTE page?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260723-series-vmap-race-fix-v6-0-8cc77dcc0018@kernel.org?part=2