From: Andrew Morton <akpm@linux-foundation.org>
To: "Lorenzo Stoakes (ARM)" <ljs@kernel.org>,
Suren Baghdasaryan <surenb@google.com>,
"Liam R. Howlett" <liam@infradead.org>,
Vlastimil Babka <vbabka@kernel.org>,
Shakeel Butt <shakeel.butt@linux.dev>,
David Hildenbrand <david@kernel.org>,
Mike Rapoport <rppt@kernel.org>, Michal Hocko <mhocko@suse.com>,
Uladzislau Rezki <urezki@gmail.com>,
Toshi Kani <toshi.kani@hpe.com>,
Dave Hansen <dave.hansen@linux.intel.com>,
Andy Lutomirski <luto@kernel.org>,
Peter Zijlstra <peterz@infradead.org>,
Thomas Gleixner <tglx@kernel.org>, Ingo Molnar <mingo@redhat.com>,
Borislav Petkov <bp@alien8.de>,
x86@kernel.org, "H. Peter Anvin" <hpa@zytor.com>,
Kiryl Shutsemau <kas@kernel.org>,
Catalin Marinas <catalin.marinas@arm.com>,
Will Deacon <will@kernel.org>, Dev Jain <dev.jain@arm.com>,
Ryan Roberts <ryan.roberts@arm.com>,
David Carlier <devnexen@gmail.com>,
linux-mm@kvack.org, linux-kernel@vger.kernel.org,
bpf@vger.kernel.org, linux-arm-kernel@lists.infradead.org,
"Denis V. Lunev" <den@virtuozzo.com>,
"Borah, Chaitanya Kumar" <chaitanya.kumar.borah@intel.com>,
stable@vger.kernel.org,
syzbot+fd95a72470f5a44e464c@syzkaller.appspotmail.com
Subject: Re: [PATCH mm-hotfixes v6 0/5] mm: fix UAF caused by race between ptdump and vmap pgtable freeing
Date: Thu, 23 Jul 2026 16:32:33 -0700 [thread overview]
Message-ID: <20260723163233.54b38cfc682a25eb6edf7cc7@linux-foundation.org> (raw)
In-Reply-To: <20260723162646.350cf3bf415a0855140d139b@linux-foundation.org>
On Thu, 23 Jul 2026 16:26:46 -0700 Andrew Morton <akpm@linux-foundation.org> wrote:
> @@ -1250,7 +1251,11 @@ static int split_large_page(struct cpa_d
>
> if (!debug_pagealloc_enabled())
> spin_unlock(&cpa_lock);
> + if (cpa->init_mm_read_locked)
> + mmap_read_unlock(&init_mm);
> ptdesc = pagetable_alloc(GFP_KERNEL, 0);
> + if (cpa->init_mm_read_locked)
> + mmap_read_lock(&init_mm);
> if (!debug_pagealloc_enabled())
> spin_lock(&cpa_lock);
> if (!ptdesc)
btw, this affects your later "x86/mm/pat: allocate split page tables as
kernel page tables". Which I resolved thusly:
static int split_large_page(struct cpa_data *cpa, pte_t *kpte,
unsigned long address)
{
pte_t *pte;
if (!debug_pagealloc_enabled())
spin_unlock(&cpa_lock);
if (cpa->init_mm_read_locked)
mmap_read_unlock(&init_mm);
pte = pte_alloc_one_kernel(&init_mm);
if (cpa->init_mm_read_locked)
mmap_read_lock(&init_mm);
if (!debug_pagealloc_enabled())
spin_lock(&cpa_lock);
if (!pte)
return -ENOMEM;
if (__split_large_page(cpa, kpte, address, pte))
pte_free_kernel(&init_mm, pte);
return 0;
}
next prev parent reply other threads:[~2026-07-23 23:32 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-23 15:16 [PATCH mm-hotfixes v6 0/5] mm: fix UAF caused by race between ptdump and vmap pgtable freeing Lorenzo Stoakes (ARM)
2026-07-23 15:16 ` [PATCH mm-hotfixes v6 1/5] mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF Lorenzo Stoakes (ARM)
2026-07-23 15:16 ` [PATCH mm-hotfixes v6 2/5] x86/mm/pat: acquire init_mm write lock on collapse to avoid UAF Lorenzo Stoakes (ARM)
2026-07-23 15:16 ` [PATCH mm-hotfixes v6 3/5] x86/mm/pat: acquire init_mm read lock on attribute change " Lorenzo Stoakes (ARM)
2026-07-23 15:16 ` [PATCH mm-hotfixes v6 4/5] mm/ptdump: always stabilise against page table freeing using init_mm Lorenzo Stoakes (ARM)
2026-07-23 15:16 ` [PATCH mm-hotfixes v6 5/5] arm64: remove redundant concurrent ptdump UAF mitigation Lorenzo Stoakes (ARM)
2026-07-23 23:26 ` [PATCH mm-hotfixes v6 0/5] mm: fix UAF caused by race between ptdump and vmap pgtable freeing Andrew Morton
2026-07-23 23:32 ` Andrew Morton [this message]
2026-07-24 15:09 ` Lorenzo Stoakes (ARM)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260723163233.54b38cfc682a25eb6edf7cc7@linux-foundation.org \
--to=akpm@linux-foundation.org \
--cc=bp@alien8.de \
--cc=bpf@vger.kernel.org \
--cc=catalin.marinas@arm.com \
--cc=chaitanya.kumar.borah@intel.com \
--cc=dave.hansen@linux.intel.com \
--cc=david@kernel.org \
--cc=den@virtuozzo.com \
--cc=dev.jain@arm.com \
--cc=devnexen@gmail.com \
--cc=hpa@zytor.com \
--cc=kas@kernel.org \
--cc=liam@infradead.org \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=ljs@kernel.org \
--cc=luto@kernel.org \
--cc=mhocko@suse.com \
--cc=mingo@redhat.com \
--cc=peterz@infradead.org \
--cc=rppt@kernel.org \
--cc=ryan.roberts@arm.com \
--cc=shakeel.butt@linux.dev \
--cc=stable@vger.kernel.org \
--cc=surenb@google.com \
--cc=syzbot+fd95a72470f5a44e464c@syzkaller.appspotmail.com \
--cc=tglx@kernel.org \
--cc=toshi.kani@hpe.com \
--cc=urezki@gmail.com \
--cc=vbabka@kernel.org \
--cc=will@kernel.org \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox