Re: [PATCH v3] mm: pgtable: protect lockless kernel page table walks with RCU

[Matthew Wilcox]

On Fri, Jun 12, 2026 at 06:23:55PM +0100, David Carlier wrote:
> ptdump walks the kernel page tables locklessly through
> walk_kernel_page_table_range_lockless().  It only holds the init_mm
> mmap lock and the memory hotplug lock, and neither excludes
> vmalloc/ioremap teardown from freeing kernel PTE pages via
> pmd_free_pte_page() -> pagetable_free_kernel().  syzbot hit a
> use-after-free in ptdump_pte_entry() reading a PTE page that was freed
> underneath the walk.

Does it make sense to walk the iomap / vmap ranges in ptdump?  I can't
really tell if this is something that's useful, or something that nobody
thought to exclude.