Re: [PATCH v2] futex: Use-after-free between futex_key_to_node_opt and vma_replace_policy

[Thomas Gleixner <tglx@kernel.org>]

On Sun, Mar 22 2026 at 07:57, Hao-Yu Yang wrote:

> On Fri, Mar 13, 2026 at 08:47:56PM +0800, Hao-Yu Yang wrote:
>> During futex_key_to_node_opt() execution, vma->vm_policy is read under
>> speculative mmap lock and RCU. Concurrently, mbind() may call
>> vma_replace_policy() which frees the old mempolicy immediately via
>> kmem_cache_free().
>> 
>> This creates a race where __futex_key_to_node() dereferences a freed
>> mempolicy pointer, causing a use-after-free read of mpol->mode.
>> 
>> [  151.412631] BUG: KASAN: slab-use-after-free in __futex_key_to_node (kernel/futex/core.c:349)
>> [  151.414046] Read of size 2 at addr ffff888001c49634 by task e/87
>> [  151.414476]
>> [  151.415431] CPU: 1 UID: 1000 PID: 87 Comm: e Not tainted 7.0.0-rc3-g0257f64bdac7 #1 PREEMPT(lazy)
>> [  151.415758] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
>> [  151.415969] Call Trace:
>> [  151.416059]  <TASK>
>> [  151.416161]  dump_stack_lvl (lib/dump_stack.c:123)
>> [  151.416299]  print_report (mm/kasan/report.c:379 mm/kasan/report.c:482)
>> [  151.416359]  ? __virt_addr_valid (./include/linux/mmzone.h:2046 ./include/linux/mmzone.h:2198 arch/x86/mm/physaddr.c:54)
>> [  151.416412]  ? __futex_key_to_node (kernel/futex/core.c:349)
>> [  151.416517]  ? kasan_complete_mode_report_info (mm/kasan/report_generic.c:182)
>> [  151.416583]  ? __futex_key_to_node (kernel/futex/core.c:349)
>> [  151.416631]  kasan_report (mm/kasan/report.c:597)
>> [  151.416677]  ? __futex_key_to_node (kernel/futex/core.c:349)
>> [  151.416732]  __asan_load2 (mm/kasan/generic.c:271)
>> [  151.416777]  __futex_key_to_node (kernel/futex/core.c:349)
>> [  151.416822]  get_futex_key (kernel/futex/core.c:374 kernel/futex/core.c:386 kernel/futex/core.c:593)
>> [  151.416871]  ? __pfx_get_futex_key (kernel/futex/core.c:550)
>> [  151.416927]  futex_wake (kernel/futex/waitwake.c:165)
>> [  151.416976]  ? __pfx_futex_wake (kernel/futex/waitwake.c:156)
>> [  151.417022]  ? __pfx___x64_sys_futex_wait (kernel/futex/syscalls.c:398)
>> [  151.417081]  __x64_sys_futex_wake (kernel/futex/syscalls.c:382 kernel/futex/syscalls.c:366 kernel/futex/syscalls.c:366)
>> [  151.417129]  x64_sys_call (arch/x86/entry/syscall_64.c:41)
>> [  151.417236]  do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
>> [  151.417342]  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
>> [  151.418312]  </TASK>
>> 
>> Fix by adding rcu to __mpol_put().
>> 
>> change-log:
>>  v2-v1: add rcu to __mpol_put
>> 
>> Fixes: c042c505210d ("futex: Implement FUTEX2_MPOL")
>> Reported-by: Hao-Yu Yang <naup96721@gmail.com>
>> Signed-off-by: Hao-Yu Yang <naup96721@gmail.com>
>> ---
>>  include/linux/mempolicy.h | 1 +
>>  mm/mempolicy.c            | 2 +-
>>  2 files changed, 2 insertions(+), 1 deletion(-)
>> 
>> diff --git a/include/linux/mempolicy.h b/include/linux/mempolicy.h
>> index 0fe96f3ab3ef..65c732d440d2 100644
>> --- a/include/linux/mempolicy.h
>> +++ b/include/linux/mempolicy.h
>> @@ -55,6 +55,7 @@ struct mempolicy {
>>  		nodemask_t cpuset_mems_allowed;	/* relative to these nodes */
>>  		nodemask_t user_nodemask;	/* nodemask passed by user */
>>  	} w;
>> +	struct rcu_head rcu;
>>  };
>>  
>>  /*
>> diff --git a/mm/mempolicy.c b/mm/mempolicy.c
>> index 0e5175f1c767..6dc61a3d4a32 100644
>> --- a/mm/mempolicy.c
>> +++ b/mm/mempolicy.c
>> @@ -487,7 +487,7 @@ void __mpol_put(struct mempolicy *pol)
>>  {
>>  	if (!atomic_dec_and_test(&pol->refcnt))
>>  		return;
>> -	kmem_cache_free(policy_cache, pol);
>> +	kfree_rcu(pol, rcu);
>>  }
>>  EXPORT_SYMBOL_FOR_MODULES(__mpol_put, "kvm");
>>  
>> -- 
>> 2.34.1
>> 
>
> Hi, I’d like to kindly ask if there’s an update on when this patch might be merged.

Thanks for the reminder. I'll take care of it tomorrow

Thanks,

        tglx