CVE-2024-42233

In the Linux kernel, the following vulnerability has been resolved:

filemap: replace pteoffsetmap() with pteoffsetmap_nolock()

The vmf->ptl in filemapfaultrecheckptenone() is still set from handleptefault(). But at the same time, we did a pteunmap(vmf->pte). After a pteunmap(vmf->pte) unmap and rcureadunlock(), the page table may be racily changed and vmf->ptl maybe fails to protect the actual page table. Fix this by replacing pteoffsetmap() with pteoffsetmap_nolock().

As David said, the PTL pointer might be stale so if we continue to use it infilemapfaultrecheckptenone(), it might trigger UAF. Also, if the PTL fails, the issue fixed by commit 58f327f2ce80 ("filemap: avoid unnecessary major faults in filemap_fault()") might reappear.