Linux 7.2-rc7 Addresses A "Nasty" Race Condition Leading To Use-After-Free After 8 Years

The Linux kernel Git activity continues being quite heavy this week on fixes. It's looking like the Linux 7.2-rc7 kernel release on Sunday will be another big one with the changes continuing to flow in from both developers and AI bots. Catching my eye overnight from the Git activity are the memory management "MM" fixes that include addressing a longstanding bug. Andrew Morton remarked in the MM fixes: "There's a patch series from Lorenzo "mm: fix UAF caused by race between ptdump and vmap pgtable freeing" which addresses a quite old bug in the ptdump code." That quite old bug has been in the Linux kernel for the past eight years with memory management changes made back in March 2018 for Linux 4.16. PTDUMP is the Linux interface for dumping the kernel's page tables in human-readable form for helping developers spot security issues and verifying memory protection and other debugging assistance and auditing. But it turns out there's been a nasty race condition there that can lead to use-after-free (UAF) behavior. Lorenzo Stoakes explained in the now-merged patch addressing this defect around the PTDUMP code: "Currently there is a nasty race between ptdump and vmap when attempting to map a huge P4D, PMD or PUD entry. ... This means that a use-after-free becomes possible if the ptdump page table walker happens to be walking a PUD, PMD or PTE page table after it has been freed." The UAF was picked up by Syzbot in June. Lorenzo reworked a patch originally devised by David Carlier with the assistance of Claude Opus 4.8 in hunting down this UAF issue. In any event that issue is now resolved and merged ahead of Linux 7.2-rc7 and will likely be back-ported to stable Linux kernel versions in the coming days.