Affected: Linux

In the Linux kernel, the following vulnerability has been resolved:

mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF

Patch series "mm: fix UAF caused by race between ptdump and vmap pgtable freeing", v6.

Kernel page table walkers fall into two broad categories - those ranges where no exclusion is required via walk_kernel_page_table_range_lockless() and those where exclusion is required via walk_kernel_page_table_range() or walk_page_range_debug().

The former category is used only by arm64 arch code operating on ranges it both wholly owns and does not concurrently write.

The latter category consists of kernel page table walkers operating on ranges that are wholly owned (but which need exclusion against concurrent writers).

The lock used for exclusion is the mmap lock, and for kernel ranges this is the mmap lock on init_mm.

ptdump is a special case being both the only user of walk_page_range_debug(), and the only case in which it walks ranges it does not own.

This presents a problem, as page tables may be freed under ptdump. And indeed there is a use-after-free bug in the kernel as a result, which this series addresses.

vmap promotes page tables to huge leaf entries where possible, freeing the lower page table when it does. It does this with no meaningful locks held against concurrent ptdump walks.

As a result, use-after-free can currently occur. This series addresses the issue by having the vmap huge promotion logic acquire the mmap read lock whi…