Re: [PATCH v2] futex: Use-after-free between futex_key_to_node_opt and vma_replace_policy

[Hao-Yu Yang <naup96721@gmail.com>]

Sorry, I'm not familier RCU and mempolicy. I don't know how to patch this part correctly.

On Mon, Mar 23, 2026 at 06:24:42PM +0100, Thomas Gleixner wrote:
> Hao-Yu!
> 
> On Fri, Mar 13 2026 at 20:47, Hao-Yu Yang wrote:
> 
> I've removed the security list as this is public already.
> Also added the mm list and the maintainers. While it fixes the futex
> problem it is a change to the MM subsystem, so those people need to be
> involved.
> 
> > During futex_key_to_node_opt() execution, vma->vm_policy is read under
> > speculative mmap lock and RCU. Concurrently, mbind() may call
> > vma_replace_policy() which frees the old mempolicy immediately via
> > kmem_cache_free().
> >
> > This creates a race where __futex_key_to_node() dereferences a freed
> > mempolicy pointer, causing a use-after-free read of mpol->mode.
> 
> > [  151.412631] BUG: KASAN: slab-use-after-free in __futex_key_to_node (kernel/futex/core.c:349)
> > [  151.414046] Read of size 2 at addr ffff888001c49634 by task e/87
> > [  151.414476]
> > [  151.415431] CPU: 1 UID: 1000 PID: 87 Comm: e Not tainted 7.0.0-rc3-g0257f64bdac7 #1 PREEMPT(lazy)
> > [  151.415758] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
> > [  151.415969] Call Trace:
> > [  151.416059]  <TASK>
> > [  151.416161]  dump_stack_lvl (lib/dump_stack.c:123)
> > [  151.416299]  print_report (mm/kasan/report.c:379 mm/kasan/report.c:482)
> > [  151.416359]  ? __virt_addr_valid (./include/linux/mmzone.h:2046 ./include/linux/mmzone.h:2198 arch/x86/mm/physaddr.c:54)
> > [  151.416412]  ? __futex_key_to_node (kernel/futex/core.c:349)
> > [  151.416517]  ? kasan_complete_mode_report_info (mm/kasan/report_generic.c:182)
> > [  151.416583]  ? __futex_key_to_node (kernel/futex/core.c:349)
> > [  151.416631]  kasan_report (mm/kasan/report.c:597)
> > [  151.416677]  ? __futex_key_to_node (kernel/futex/core.c:349)
> > [  151.416732]  __asan_load2 (mm/kasan/generic.c:271)
> > [  151.416777]  __futex_key_to_node (kernel/futex/core.c:349)
> > [  151.416822]  get_futex_key (kernel/futex/core.c:374 kernel/futex/core.c:386 kernel/futex/core.c:593)
> > [  151.416871]  ? __pfx_get_futex_key (kernel/futex/core.c:550)
> > [  151.416927]  futex_wake (kernel/futex/waitwake.c:165)
> > [  151.416976]  ? __pfx_futex_wake (kernel/futex/waitwake.c:156)
> > [  151.417022]  ? __pfx___x64_sys_futex_wait (kernel/futex/syscalls.c:398)
> > [  151.417081]  __x64_sys_futex_wake (kernel/futex/syscalls.c:382 kernel/futex/syscalls.c:366 kernel/futex/syscalls.c:366)
> > [  151.417129]  x64_sys_call (arch/x86/entry/syscall_64.c:41)
> > [  151.417236]  do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
> > [  151.417342]  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
> > [  151.418312]  </TASK>
> 
> Please trim the backtrace so it only contains the real important
> information.
> 
>   https://docs.kernel.org/process/submitting-patches.html#backtraces-in-commit-messages
> 
> > Fix by adding rcu to __mpol_put().
> >
> > change-log:
> >  v2-v1: add rcu to __mpol_put
> 
> The change history is not part of the change log, it want's to be placed
> after the --- separator.
> 
> > Fixes: c042c505210d ("futex: Implement FUTEX2_MPOL")
> > Reported-by: Hao-Yu Yang <naup96721@gmail.com>
> > Signed-off-by: Hao-Yu Yang <naup96721@gmail.com>
> 
> This should have a
> 
>      Suggested-by: Eric Dumazet <edumazet@google.com>
> 
> tag.
> 
> > ---
> >  include/linux/mempolicy.h | 1 +
> >  mm/mempolicy.c            | 2 +-
> >  2 files changed, 2 insertions(+), 1 deletion(-)
> >
> > diff --git a/include/linux/mempolicy.h b/include/linux/mempolicy.h
> > index 0fe96f3ab3ef..65c732d440d2 100644
> > --- a/include/linux/mempolicy.h
> > +++ b/include/linux/mempolicy.h
> > @@ -55,6 +55,7 @@ struct mempolicy {
> >  		nodemask_t cpuset_mems_allowed;	/* relative to these nodes */
> >  		nodemask_t user_nodemask;	/* nodemask passed by user */
> >  	} w;
> > +	struct rcu_head rcu;
> >  };
> >  
> >  /*
> > diff --git a/mm/mempolicy.c b/mm/mempolicy.c
> > index 0e5175f1c767..6dc61a3d4a32 100644
> > --- a/mm/mempolicy.c
> > +++ b/mm/mempolicy.c
> > @@ -487,7 +487,7 @@ void __mpol_put(struct mempolicy *pol)
> >  {
> >  	if (!atomic_dec_and_test(&pol->refcnt))
> >  		return;
> > -	kmem_cache_free(policy_cache, pol);
> > +	kfree_rcu(pol, rcu);
> >  }
> >  EXPORT_SYMBOL_FOR_MODULES(__mpol_put, "kvm");
> 
> While this looks functionally correct it is incomplete in terms of RCU.
> 
> The vma->vm_policy pointer needs to be marked __rcu. That then requires
> to use rcu_dereference_check() at the reader side and
> rcu_assign_pointer() and rcu_replace_pointer() on the writer side.
> 
> Especially the writer side is required so that the proper memory
> barriers are inserted for architectures with a weakly ordered memory
> model.
> 
> Thanks,
> 
>         tglx