Re: [PATCH] mm/ksm: avoid anon_vma UAF during page merging

[Lorenzo Stoakes (ARM)]

On Sun, Nov 01, 2026 at 07:11:25PM +0100, David Hildenbrand (Arm) wrote:
> On 10/31/26 19:22, Zhao Gongyi wrote:
>
> Hi,
>
> thanks for the report! CCing Lorenzo.
>
> > KASAN reports a use-after-free in page_address_in_vma() while ksmd
> > merges pages. ksmd keeps a folio reference across an mmap_lock drop,
> > during which mremap() can remove its last mapping and free its
> > anon_vma. page_address_in_vma() then dereferences the stale pointer
> > from folio->mapping.

Fun fun. KSM is dropping the lock then assuming the VMA doesn't change.

I want to take a different approach to this fix so I'll take it over.

>
> Do you have a link to the report or the actual KASAN report?

Thanks, the attached report is useful.

--
Cheers, Lorenzo