Re: [PATCH v2] futex: Use-after-free between futex_key_to_node_opt and vma_replace_policy

[Greg KH <gregkh@linuxfoundation.org>]

On Fri, Mar 13, 2026 at 08:39:40PM +0800, Hao-Yu Yang wrote:
> During futex_key_to_node_opt() execution, vma->vm_policy is read under
> speculative mmap lock and RCU. Concurrently, mbind() may call
> vma_replace_policy() which frees the old mempolicy immediately via
> kmem_cache_free().
> 
> This creates a race where __futex_key_to_node() dereferences a freed
> mempolicy pointer, causing a use-after-free read of mpol->mode.

As this is sent to lkml in public, no need to get security@k.o involved.

> [  151.412631] BUG: KASAN: slab-use-after-free in __futex_key_to_node (kernel/futex/core.c:349)
> [  151.414046] Read of size 2 at addr ffff888001c49634 by task e/87
> [  151.414476]
> [  151.415431] CPU: 1 UID: 1000 PID: 87 Comm: e Not tainted 7.0.0-rc3-g0257f64bdac7 #1 PREEMPT(lazy)
> [  151.415758] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
> [  151.415969] Call Trace:
> [  151.416059]  <TASK>
> [  151.416161]  dump_stack_lvl (lib/dump_stack.c:123)
> [  151.416299]  print_report (mm/kasan/report.c:379 mm/kasan/report.c:482)
> [  151.416359]  ? __virt_addr_valid (./include/linux/mmzone.h:2046 ./include/linux/mmzone.h:2198 arch/x86/mm/physaddr.c:54)
> [  151.416412]  ? __futex_key_to_node (kernel/futex/core.c:349)
> [  151.416517]  ? kasan_complete_mode_report_info (mm/kasan/report_generic.c:182)
> [  151.416583]  ? __futex_key_to_node (kernel/futex/core.c:349)
> [  151.416631]  kasan_report (mm/kasan/report.c:597)
> [  151.416677]  ? __futex_key_to_node (kernel/futex/core.c:349)
> [  151.416732]  __asan_load2 (mm/kasan/generic.c:271)
> [  151.416777]  __futex_key_to_node (kernel/futex/core.c:349)
> [  151.416822]  get_futex_key (kernel/futex/core.c:374 kernel/futex/core.c:386 kernel/futex/core.c:593)
> [  151.416871]  ? __pfx_get_futex_key (kernel/futex/core.c:550)
> [  151.416927]  futex_wake (kernel/futex/waitwake.c:165)
> [  151.416976]  ? __pfx_futex_wake (kernel/futex/waitwake.c:156)
> [  151.417022]  ? __pfx___x64_sys_futex_wait (kernel/futex/syscalls.c:398)
> [  151.417081]  __x64_sys_futex_wake (kernel/futex/syscalls.c:382 kernel/futex/syscalls.c:366 kernel/futex/syscalls.c:366)
> [  151.417129]  x64_sys_call (arch/x86/entry/syscall_64.c:41)
> [  151.417236]  do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
> [  151.417342]  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
> [  151.418312]  </TASK>
> 
> Fix by adding rcu to __mpol_put().
> 
> change-log:
>  v2-v1: add rcu to __mpol_put

This goes below the --- line.

> 
> Fixes: c042c505210d ("futex: Implement FUTEX2_MPOL")
> Reported-by: Hao-Yu Yang <naup96721@gmail.com>
> Signed-off-by: Hao-Yu Yang <naup96721@gmail.com>
> ---

No cc: stable?

thanks,

greg k-h