[PATCH v2 0/5] x86/mm/pat: CPA fixes

From: Mike Rapoport

Date: Thu Aug 13 2026 - 05:04:57 EST


The first three patches are urgent, the third patch fixes BUG() reported
y several people and it depends on the first two.

There were no bug reports that the last two patches fix because bug
manifestations won't yell at users.

TL;DR version:

There are a couple of CPA fixes floating around:

Denis Lunev fixed races between split and collapse of the large mappings:

https://lore.kernel.org/all/20260715183453.2381141-1-den@xxxxxxxxxx

Lorenzo Stoakes fixed UAF caused by races between CPA and ptdump:

https://lore.kernel.org/all/20260723-series-vmap-race-fix-v6-0-8cc77dcc0018@xxxxxxxxxx

and an issue with stale page tables in IOMMU:

https://lore.kernel.org/all/20260721-fix-cpa-kernel-pagetables-v2-1-2b255deed710@xxxxxxxxxx

Mike Rapoport fixed a check of RW attribute in lookup_address_in_pgd_attr()
used for the verification of RWX:

https://lore.kernel.org/all/20260715144519.934289-1-rppt@xxxxxxxxxx

Pedro Falcato closed a race between text poking and collapse of large
pages:

https://lore.kernel.org/all/anCK3eWFMwZqq5ka@pedro-suse

Some of the fixes got merged into x86 tree, some of them got merged into mm
tree and some are still hanging in the air.

The changes here are collected from all these fixes into a single coherent
set on top of tip/x86/mm:

* fix for races between CPA and ptdump causing UAF
* update to the fix of the race between split and collapse of large
mappings
* fix for races between CPA and vmalloc_to_page() in text poking
* fix for stale page tables in IOMMU
* fix for effective RW computation in lookup_address_in_pgd_attr()

---
v2 changes:
* rebased on the current tip/x86/mm that includes peterz's changes for
DEBUG_PAGEALLOC
* added fix for CPA vs text poking race

v1: https://patch.msgid.link/20260728-cpa-fixes-v1-0-2ed2352300b3@xxxxxxxxxx

---
Lorenzo Stoakes (ARM) (3):
x86/mm/pat: acquire init_mm write lock on collapse to avoid UAF
x86/mm/pat: acquire init_mm read lock on attribute change to avoid UAF
x86/mm/pat: allocate split page tables as kernel page tables

Mike Rapoport (Microsoft) (1):
x86/mm/pat: fix effective RW computation in lookup_address_in_pgd_attr()

Pedro Falcato (1):
x86/alternative: exclude text poking against change_page_attr()

arch/x86/kernel/alternative.c | 39 ++++++++++++++++++++++++---
arch/x86/mm/pat/set_memory.c | 61 +++++++++++++++++++++++++++++++------------
include/linux/mmap_lock.h | 2 ++
3 files changed, 83 insertions(+), 19 deletions(-)
---
base-commit: 7da514d819a0afb148634aac92b3d190f34947c3
change-id: 20260727-cpa-fixes-d3c73c075672

--
Sincerely yours,
Mike.