Patch Series

Subject Fix stale IOTLB entries for kernel address space
Author baolu.lu@linux.intel.com
Date 2025-10-14 13:04:31 +0000 UTC
Version 6
Cc akpm@linux-foundation.org apopple@nvidia.com baolu.lu@linux.intel.com bp@alien8.de dave.hansen@intel.com dave.hansen@linux.intel.com david@redhat.com iommu@lists.linux.dev jannh@google.com jean-philippe@linaro.org jgg@nvidia.com joro@8bytes.org kevin.tian@intel.com liam.howlett@oracle.com linux-kernel@vger.kernel.org linux-mm@kvack.org lorenzo.stoakes@oracle.com luto@kernel.org mhocko@kernel.org mingo@redhat.com peterz@infradead.org robin.murphy@arm.com rppt@kernel.org security@kernel.org stable@vger.kernel.org tglx@linutronix.de urezki@gmail.com vasant.hegde@amd.com vbabka@suse.cz will@kernel.org willy@infradead.org x86@kernel.org yi1.lai@intel.com

Patches (7)

Name Content
[PATCH v6 1/7] mm: Add a ptdesc flag to mark kernel page tables [Body]
[PATCH v6 2/7] mm: Actually mark kernel page table pages [Body]
[PATCH v6 3/7] x86/mm: Use 'ptdesc' when freeing PMD pages [Body]
[PATCH v6 4/7] mm: Introduce pure page table freeing function [Body]
[PATCH v6 5/7] x86/mm: Use pagetable_free() [Body]
[PATCH v6 6/7] mm: Introduce deferred freeing for kernel page tables [Body]
[PATCH v6 7/7] iommu/sva: Invalidate stale IOTLB entries for kernel address space [Body]

Session 2025-10-14

ID (for dev) 9b592ffa-7012-4d06-905c-b596c91c3edc
Status finished
Triaged OK [Log]
Execution Log [Link]
Test Base Patched Verdict
[KASAN] Build Base 0d97f2067c166eb495771fede9f7b73999c67f66 [Config] passed [Log]
[KASAN] Boot test: Base 0d97f2067c166eb495771fede9f7b73999c67f66 [Config] passed
[KASAN] Build Patched 0d97f2067c166eb495771fede9f7b73999c67f66 [Config] [patched] passed [Log]
[KASAN] Boot test: Patched 0d97f2067c166eb495771fede9f7b73999c67f66 [Config] [patched] passed
[KASAN] Fuzzing 0d97f2067c166eb495771fede9f7b73999c67f66 [Config] 0d97f2067c166eb495771fede9f7b73999c67f66 [Config] [patched] passed [Log] [Artifacts]
KASAN: use-after-free Read in pmd_set_huge [Log] [Syz Repro]
KASAN: use-after-free Read in vmap_range_noflush [Log] [Syz Repro] [C Repro]
PANIC: double fault in search_extable [Log] [Syz Repro]