[PATCH 0/5] x86/mm/pat: CPA fixes
"Mike Rapoport (Microsoft)" <[email protected]> Tue, 28 Jul 2026 16:07:43 +0300
| Newsgroups | dev.linux.lists.iommu,org.kernel.vger.linux-kernel,org.kernel.vger.stable,org.kvack.linux-mm |
|---|---|
| Message-ID | <[email protected]> |
There are a couple of CPA fixes floating around: Denis Lunev fixed races between split and collapse of the large mappings: https://lore.kernel.org/all/[email protected] Lorenzo Stoakes fixed UAF caused by races between CPA and ptdump: https://lore.kernel.org/all/[email protected] and an issue with stale page tables in IOMMU: https://lore.kernel.org/all/[email protected] Mike Rapoport fixed a check of RW attribute in lookup_address_in_pgd_attr() used for the verification of RWX: https://lore.kernel.org/all/[email protected] Some of the fixes got merged into x86 tree, some of them got merged into mm tree and some are still hanging in the air. Beside the fixes there was a supposed simplification of cpa_lock locking that looked like removal of an optimization for DEBUG_PAGEALLOC, but it turned out that it was not an optimization but rather a correctness guard because with DEBUG_PAGEALLOC the locks could be taken in an atomic context and couldn't use plain spin_lock()/spin_unlock(). The changes here are collected from all these fixes into a sinlge coherent set on top of tip/x86/mm: * update to cpa_lock handling with DEBUG_PAGEALLOC * fix for races between CPA and ptdumpi causing UAF * fix for stale page tables in IOMMU * update to the fix of the race between split and collapse of large mappings * fix for effective RW computation in lookup_address_in_pgd_attr() Signed-off-by: Mike Rapoport (Microsoft) <[email protected]> --- Lorenzo Stoakes (ARM) (3): x86/mm/pat: acquire init_mm write lock on collapse to avoid UAF x86/mm/pat: acquire init_mm read lock on attribute change to avoid UAF x86/mm/pat: allocate split page tables as kernel page tables Mike Rapoport (Microsoft) (2): x86/mm/pat: introcude cpa_lock() and cpa_unlock() x86/mm/pat: fix effective RW computation in lookup_address_in_pgd_attr() arch/x86/mm/pat/set_memory.c | 95 +++++++++++++++++++++++++++++++------------- include/linux/mmap_lock.h | 2 + 2 files changed, 70 insertions(+), 27 deletions(-) --- base-commit: a5a162fe1ae130e3d2ceefef3f43afe3773c1d56 change-id: 20260727-cpa-fixes-d3c73c075672 -- Sincerely yours, Mike.