Kernel roundup: ptdump use-after-free fix, taskstats cpumask bug, RISC-V IOMMU MSI, and QCE removal fight

A use-after-free race between kernel page-table dumping and vmap huge-page promotion is the most serious item in a cluster of memory-management, IOMMU, stats, and crypto threads on linux-kernel this week.

Lorenzo Stoakes posted a five-part mm-hotfixes series that stops ptdump from walking page tables that vmap (and x86 Change Page Attributes collapse) can free underneath it. ptdump is the odd walker: it covers kernel ranges it does not own and already takes the init_mm mmap write lock. vmap’s huge promotion paths were freeing lower-level tables with no matching exclusion. The fix has those paths take the mmap read lock (via trylock so ptdump cannot stall mapping progress) while installing the huge entry and freeing the old table, so the walker only ever sees a consistent huge or non-huge entry. An earlier arm64-only mitigation is carefully avoided so the new locking does not deadlock under rwsem anti-starvation rules. The same class of unlocked free shows up in x86 CPA collapse used by execmem and BPF ROX restoration.

Separately, Oleg Deomi reported that TASKSTATS REGISTER_CPUMASK silently drops the last byte of the cpumask string. parse() allocated exactly nla_len bytes and passed that length to nla_strscpy, which always needs one byte of headroom for its NUL, so a request like "0-31" was parsed as "0-3" with a successful ACK. Andrew Morton queued a one-line larger allocation; Bradley Morgan noted that dstsize was still wrong and that nla_strdup (or passing len+1) is required. The bug is old and only bites senders that omit a trailing NUL, which the NLA_STRING policy allows.

On the IOMMU side, Andrew Jones sent a 14-part v2 for RISC-V that adds MSI remapping for IMSIC so device MSI targets are translated like DMA. That unblocks enabling IOMMU_DMA and paging domains by default and improves VFIO readiness. The series follows the ARM prepare/compose shape but pre-maps every IMSIC page into a domain-wide PA-to-IOVA table because IMSIC target addresses change on affinity in atomic context. Supporting iommufd changes grow the SW MSI bitmap on demand and add a descriptor-free map helper.

Finally, Eric Biggers proposed deleting the already-BROKEN Qualcomm QCE crypto driver outright, arguing it is unused in practice, far slower than ARMv8 CE or the inline engine, and a maintenance hazard. Greg Kroah-Hartman acked; discussion continues over whether any future restricted-media use belongs in a clean, separate design rather than keeping this code.