Re: [PATCH v5 0/3] mm: khugepaged: fix tracepoint UAF

[Andrew Morton <akpm@linux-foundation.org>]

On Wed,  9 Sep 2026 10:58:00 +0800 Vernon Yang <vernon2gm@gmail.com> wrote:

> From: Vernon Yang <yanglincheng@kylinos.cn>
> 
> The khugepaged tracepoints take a folio pointer and call folio_pfn(),
> but by then the folio may no longer be valid: freed after folio_put(),
> folio_unlock() or pte_unmap_unlock(), or not a folio at all but an
> xarray-encoded swap entry. On classic SPARSEMEM, dereferencing it oopses
> khugepaged as soon as the trace event is enabled; on other memory models
> it merely prints a bogus pfn.
> 
> Pass the pfn to the tracepoints directly, captured while the folio is
> still pinned, closing the use-after-free windows in
> mm_khugepaged_scan_file(), mm_khugepaged_scan_pmd() and
> mm_khugepaged_collapse_file().

Thanks, I've updated mm.git to this version.

> V4 -> V5:
> - Use a single trace statement.
> - Collect Acked-by.

Here's how v5 altered mm.git:


 mm/khugepaged.c |   15 ++++-----------
 1 file changed, 4 insertions(+), 11 deletions(-)

--- a/mm/khugepaged.c~b
+++ a/mm/khugepaged.c
@@ -1790,13 +1790,10 @@ out_unmap:
 				       unmapped, cc, enabled_orders);
 		/* mmap_lock was released above, set lock_dropped */
 		*lock_dropped = true;
-		trace_mm_khugepaged_scan_pmd(mm, -1, referenced, none_or_zero,
-					     SCAN_SUCCEED, unmapped);
-	} else {
-out:
-		trace_mm_khugepaged_scan_pmd(mm, failed_pfn, referenced,
-					     none_or_zero, result, unmapped);
 	}
+out:
+	trace_mm_khugepaged_scan_pmd(mm, failed_pfn, referenced,
+				     none_or_zero, result, unmapped);
 	return result;
 }
 
@@ -2789,13 +2786,9 @@ static enum scan_result collapse_scan_fi
 		} else {
 			result = collapse_file(mm, addr, file, start, cc);
 		}
-		trace_mm_khugepaged_scan_file(mm, -1, file, present, swap,
-					      SCAN_SUCCEED);
-	} else {
-		trace_mm_khugepaged_scan_file(mm, failed_pfn, file, present,
-					      swap, result);
 	}
 
+	trace_mm_khugepaged_scan_file(mm, failed_pfn, file, present, swap, result);
 	return result;
 }
 
_