Re: [PATCH v2] futex: Use-after-free between futex_key_to_node_opt and vma_replace_policy

[Thomas Gleixner <tglx@kernel.org>]

Hao-Yu!

On Fri, Mar 13 2026 at 20:47, Hao-Yu Yang wrote:

I've removed the security list as this is public already.
Also added the mm list and the maintainers. While it fixes the futex
problem it is a change to the MM subsystem, so those people need to be
involved.

> During futex_key_to_node_opt() execution, vma->vm_policy is read under
> speculative mmap lock and RCU. Concurrently, mbind() may call
> vma_replace_policy() which frees the old mempolicy immediately via
> kmem_cache_free().
>
> This creates a race where __futex_key_to_node() dereferences a freed
> mempolicy pointer, causing a use-after-free read of mpol->mode.

> [  151.412631] BUG: KASAN: slab-use-after-free in __futex_key_to_node (kernel/futex/core.c:349)
> [  151.414046] Read of size 2 at addr ffff888001c49634 by task e/87
> [  151.414476]
> [  151.415431] CPU: 1 UID: 1000 PID: 87 Comm: e Not tainted 7.0.0-rc3-g0257f64bdac7 #1 PREEMPT(lazy)
> [  151.415758] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
> [  151.415969] Call Trace:
> [  151.416059]  <TASK>
> [  151.416161]  dump_stack_lvl (lib/dump_stack.c:123)
> [  151.416299]  print_report (mm/kasan/report.c:379 mm/kasan/report.c:482)
> [  151.416359]  ? __virt_addr_valid (./include/linux/mmzone.h:2046 ./include/linux/mmzone.h:2198 arch/x86/mm/physaddr.c:54)
> [  151.416412]  ? __futex_key_to_node (kernel/futex/core.c:349)
> [  151.416517]  ? kasan_complete_mode_report_info (mm/kasan/report_generic.c:182)
> [  151.416583]  ? __futex_key_to_node (kernel/futex/core.c:349)
> [  151.416631]  kasan_report (mm/kasan/report.c:597)
> [  151.416677]  ? __futex_key_to_node (kernel/futex/core.c:349)
> [  151.416732]  __asan_load2 (mm/kasan/generic.c:271)
> [  151.416777]  __futex_key_to_node (kernel/futex/core.c:349)
> [  151.416822]  get_futex_key (kernel/futex/core.c:374 kernel/futex/core.c:386 kernel/futex/core.c:593)
> [  151.416871]  ? __pfx_get_futex_key (kernel/futex/core.c:550)
> [  151.416927]  futex_wake (kernel/futex/waitwake.c:165)
> [  151.416976]  ? __pfx_futex_wake (kernel/futex/waitwake.c:156)
> [  151.417022]  ? __pfx___x64_sys_futex_wait (kernel/futex/syscalls.c:398)
> [  151.417081]  __x64_sys_futex_wake (kernel/futex/syscalls.c:382 kernel/futex/syscalls.c:366 kernel/futex/syscalls.c:366)
> [  151.417129]  x64_sys_call (arch/x86/entry/syscall_64.c:41)
> [  151.417236]  do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
> [  151.417342]  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
> [  151.418312]  </TASK>

Please trim the backtrace so it only contains the real important
information.

  https://docs.kernel.org/process/submitting-patches.html#backtraces-in-commit-messages

> Fix by adding rcu to __mpol_put().
>
> change-log:
>  v2-v1: add rcu to __mpol_put

The change history is not part of the change log, it want's to be placed
after the --- separator.

> Fixes: c042c505210d ("futex: Implement FUTEX2_MPOL")
> Reported-by: Hao-Yu Yang <naup96721@gmail.com>
> Signed-off-by: Hao-Yu Yang <naup96721@gmail.com>

This should have a

     Suggested-by: Eric Dumazet <edumazet@google.com>

tag.

> ---
>  include/linux/mempolicy.h | 1 +
>  mm/mempolicy.c            | 2 +-
>  2 files changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/include/linux/mempolicy.h b/include/linux/mempolicy.h
> index 0fe96f3ab3ef..65c732d440d2 100644
> --- a/include/linux/mempolicy.h
> +++ b/include/linux/mempolicy.h
> @@ -55,6 +55,7 @@ struct mempolicy {
>  		nodemask_t cpuset_mems_allowed;	/* relative to these nodes */
>  		nodemask_t user_nodemask;	/* nodemask passed by user */
>  	} w;
> +	struct rcu_head rcu;
>  };
>  
>  /*
> diff --git a/mm/mempolicy.c b/mm/mempolicy.c
> index 0e5175f1c767..6dc61a3d4a32 100644
> --- a/mm/mempolicy.c
> +++ b/mm/mempolicy.c
> @@ -487,7 +487,7 @@ void __mpol_put(struct mempolicy *pol)
>  {
>  	if (!atomic_dec_and_test(&pol->refcnt))
>  		return;
> -	kmem_cache_free(policy_cache, pol);
> +	kfree_rcu(pol, rcu);
>  }
>  EXPORT_SYMBOL_FOR_MODULES(__mpol_put, "kvm");

While this looks functionally correct it is incomplete in terms of RCU.

The vma->vm_policy pointer needs to be marked __rcu. That then requires
to use rcu_dereference_check() at the reader side and
rcu_assign_pointer() and rcu_replace_pointer() on the writer side.

Especially the writer side is required so that the proper memory
barriers are inserted for architectures with a weakly ordered memory
model.

Thanks,

        tglx