* [PATCH v2] futex: Use-after-free between futex_key_to_node_opt and vma_replace_policy
@ 2026-03-13 12:47 Hao-Yu Yang
2026-03-21 23:57 ` Hao-Yu Yang
0 siblings, 1 reply; 3+ messages in thread
From: Hao-Yu Yang @ 2026-03-13 12:47 UTC (permalink / raw)
To: security; +Cc: tglx, mingo, linux-kernel, stable, Hao-Yu Yang
During futex_key_to_node_opt() execution, vma->vm_policy is read under
speculative mmap lock and RCU. Concurrently, mbind() may call
vma_replace_policy() which frees the old mempolicy immediately via
kmem_cache_free().
This creates a race where __futex_key_to_node() dereferences a freed
mempolicy pointer, causing a use-after-free read of mpol->mode.
[ 151.412631] BUG: KASAN: slab-use-after-free in __futex_key_to_node (kernel/futex/core.c:349)
[ 151.414046] Read of size 2 at addr ffff888001c49634 by task e/87
[ 151.414476]
[ 151.415431] CPU: 1 UID: 1000 PID: 87 Comm: e Not tainted 7.0.0-rc3-g0257f64bdac7 #1 PREEMPT(lazy)
[ 151.415758] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
[ 151.415969] Call Trace:
[ 151.416059] <TASK>
[ 151.416161] dump_stack_lvl (lib/dump_stack.c:123)
[ 151.416299] print_report (mm/kasan/report.c:379 mm/kasan/report.c:482)
[ 151.416359] ? __virt_addr_valid (./include/linux/mmzone.h:2046 ./include/linux/mmzone.h:2198 arch/x86/mm/physaddr.c:54)
[ 151.416412] ? __futex_key_to_node (kernel/futex/core.c:349)
[ 151.416517] ? kasan_complete_mode_report_info (mm/kasan/report_generic.c:182)
[ 151.416583] ? __futex_key_to_node (kernel/futex/core.c:349)
[ 151.416631] kasan_report (mm/kasan/report.c:597)
[ 151.416677] ? __futex_key_to_node (kernel/futex/core.c:349)
[ 151.416732] __asan_load2 (mm/kasan/generic.c:271)
[ 151.416777] __futex_key_to_node (kernel/futex/core.c:349)
[ 151.416822] get_futex_key (kernel/futex/core.c:374 kernel/futex/core.c:386 kernel/futex/core.c:593)
[ 151.416871] ? __pfx_get_futex_key (kernel/futex/core.c:550)
[ 151.416927] futex_wake (kernel/futex/waitwake.c:165)
[ 151.416976] ? __pfx_futex_wake (kernel/futex/waitwake.c:156)
[ 151.417022] ? __pfx___x64_sys_futex_wait (kernel/futex/syscalls.c:398)
[ 151.417081] __x64_sys_futex_wake (kernel/futex/syscalls.c:382 kernel/futex/syscalls.c:366 kernel/futex/syscalls.c:366)
[ 151.417129] x64_sys_call (arch/x86/entry/syscall_64.c:41)
[ 151.417236] do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
[ 151.417342] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
[ 151.418312] </TASK>
Fix by adding rcu to __mpol_put().
change-log:
v2-v1: add rcu to __mpol_put
Fixes: c042c505210d ("futex: Implement FUTEX2_MPOL")
Reported-by: Hao-Yu Yang <naup96721@gmail.com>
Signed-off-by: Hao-Yu Yang <naup96721@gmail.com>
---
include/linux/mempolicy.h | 1 +
mm/mempolicy.c | 2 +-
2 files changed, 2 insertions(+), 1 deletion(-)
diff --git a/include/linux/mempolicy.h b/include/linux/mempolicy.h
index 0fe96f3ab3ef..65c732d440d2 100644
--- a/include/linux/mempolicy.h
+++ b/include/linux/mempolicy.h
@@ -55,6 +55,7 @@ struct mempolicy {
nodemask_t cpuset_mems_allowed; /* relative to these nodes */
nodemask_t user_nodemask; /* nodemask passed by user */
} w;
+ struct rcu_head rcu;
};
/*
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 0e5175f1c767..6dc61a3d4a32 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -487,7 +487,7 @@ void __mpol_put(struct mempolicy *pol)
{
if (!atomic_dec_and_test(&pol->refcnt))
return;
- kmem_cache_free(policy_cache, pol);
+ kfree_rcu(pol, rcu);
}
EXPORT_SYMBOL_FOR_MODULES(__mpol_put, "kvm");
--
2.34.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH v2] futex: Use-after-free between futex_key_to_node_opt and vma_replace_policy
2026-03-13 12:47 [PATCH v2] futex: Use-after-free between futex_key_to_node_opt and vma_replace_policy Hao-Yu Yang
@ 2026-03-21 23:57 ` Hao-Yu Yang
2026-03-22 21:42 ` Thomas Gleixner
0 siblings, 1 reply; 3+ messages in thread
From: Hao-Yu Yang @ 2026-03-21 23:57 UTC (permalink / raw)
To: security; +Cc: tglx, mingo, linux-kernel, stable
On Fri, Mar 13, 2026 at 08:47:56PM +0800, Hao-Yu Yang wrote:
> During futex_key_to_node_opt() execution, vma->vm_policy is read under
> speculative mmap lock and RCU. Concurrently, mbind() may call
> vma_replace_policy() which frees the old mempolicy immediately via
> kmem_cache_free().
>
> This creates a race where __futex_key_to_node() dereferences a freed
> mempolicy pointer, causing a use-after-free read of mpol->mode.
>
> [ 151.412631] BUG: KASAN: slab-use-after-free in __futex_key_to_node (kernel/futex/core.c:349)
> [ 151.414046] Read of size 2 at addr ffff888001c49634 by task e/87
> [ 151.414476]
> [ 151.415431] CPU: 1 UID: 1000 PID: 87 Comm: e Not tainted 7.0.0-rc3-g0257f64bdac7 #1 PREEMPT(lazy)
> [ 151.415758] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
> [ 151.415969] Call Trace:
> [ 151.416059] <TASK>
> [ 151.416161] dump_stack_lvl (lib/dump_stack.c:123)
> [ 151.416299] print_report (mm/kasan/report.c:379 mm/kasan/report.c:482)
> [ 151.416359] ? __virt_addr_valid (./include/linux/mmzone.h:2046 ./include/linux/mmzone.h:2198 arch/x86/mm/physaddr.c:54)
> [ 151.416412] ? __futex_key_to_node (kernel/futex/core.c:349)
> [ 151.416517] ? kasan_complete_mode_report_info (mm/kasan/report_generic.c:182)
> [ 151.416583] ? __futex_key_to_node (kernel/futex/core.c:349)
> [ 151.416631] kasan_report (mm/kasan/report.c:597)
> [ 151.416677] ? __futex_key_to_node (kernel/futex/core.c:349)
> [ 151.416732] __asan_load2 (mm/kasan/generic.c:271)
> [ 151.416777] __futex_key_to_node (kernel/futex/core.c:349)
> [ 151.416822] get_futex_key (kernel/futex/core.c:374 kernel/futex/core.c:386 kernel/futex/core.c:593)
> [ 151.416871] ? __pfx_get_futex_key (kernel/futex/core.c:550)
> [ 151.416927] futex_wake (kernel/futex/waitwake.c:165)
> [ 151.416976] ? __pfx_futex_wake (kernel/futex/waitwake.c:156)
> [ 151.417022] ? __pfx___x64_sys_futex_wait (kernel/futex/syscalls.c:398)
> [ 151.417081] __x64_sys_futex_wake (kernel/futex/syscalls.c:382 kernel/futex/syscalls.c:366 kernel/futex/syscalls.c:366)
> [ 151.417129] x64_sys_call (arch/x86/entry/syscall_64.c:41)
> [ 151.417236] do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
> [ 151.417342] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
> [ 151.418312] </TASK>
>
> Fix by adding rcu to __mpol_put().
>
> change-log:
> v2-v1: add rcu to __mpol_put
>
> Fixes: c042c505210d ("futex: Implement FUTEX2_MPOL")
> Reported-by: Hao-Yu Yang <naup96721@gmail.com>
> Signed-off-by: Hao-Yu Yang <naup96721@gmail.com>
> ---
> include/linux/mempolicy.h | 1 +
> mm/mempolicy.c | 2 +-
> 2 files changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/include/linux/mempolicy.h b/include/linux/mempolicy.h
> index 0fe96f3ab3ef..65c732d440d2 100644
> --- a/include/linux/mempolicy.h
> +++ b/include/linux/mempolicy.h
> @@ -55,6 +55,7 @@ struct mempolicy {
> nodemask_t cpuset_mems_allowed; /* relative to these nodes */
> nodemask_t user_nodemask; /* nodemask passed by user */
> } w;
> + struct rcu_head rcu;
> };
>
> /*
> diff --git a/mm/mempolicy.c b/mm/mempolicy.c
> index 0e5175f1c767..6dc61a3d4a32 100644
> --- a/mm/mempolicy.c
> +++ b/mm/mempolicy.c
> @@ -487,7 +487,7 @@ void __mpol_put(struct mempolicy *pol)
> {
> if (!atomic_dec_and_test(&pol->refcnt))
> return;
> - kmem_cache_free(policy_cache, pol);
> + kfree_rcu(pol, rcu);
> }
> EXPORT_SYMBOL_FOR_MODULES(__mpol_put, "kvm");
>
> --
> 2.34.1
>
Hi, I’d like to kindly ask if there’s an update on when this patch might be merged.
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH v2] futex: Use-after-free between futex_key_to_node_opt and vma_replace_policy
2026-03-21 23:57 ` Hao-Yu Yang
@ 2026-03-22 21:42 ` Thomas Gleixner
0 siblings, 0 replies; 3+ messages in thread
From: Thomas Gleixner @ 2026-03-22 21:42 UTC (permalink / raw)
To: Hao-Yu Yang, security; +Cc: mingo, linux-kernel, stable, Peter Zijlstra
On Sun, Mar 22 2026 at 07:57, Hao-Yu Yang wrote:
> On Fri, Mar 13, 2026 at 08:47:56PM +0800, Hao-Yu Yang wrote:
>> During futex_key_to_node_opt() execution, vma->vm_policy is read under
>> speculative mmap lock and RCU. Concurrently, mbind() may call
>> vma_replace_policy() which frees the old mempolicy immediately via
>> kmem_cache_free().
>>
>> This creates a race where __futex_key_to_node() dereferences a freed
>> mempolicy pointer, causing a use-after-free read of mpol->mode.
>>
>> [ 151.412631] BUG: KASAN: slab-use-after-free in __futex_key_to_node (kernel/futex/core.c:349)
>> [ 151.414046] Read of size 2 at addr ffff888001c49634 by task e/87
>> [ 151.414476]
>> [ 151.415431] CPU: 1 UID: 1000 PID: 87 Comm: e Not tainted 7.0.0-rc3-g0257f64bdac7 #1 PREEMPT(lazy)
>> [ 151.415758] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
>> [ 151.415969] Call Trace:
>> [ 151.416059] <TASK>
>> [ 151.416161] dump_stack_lvl (lib/dump_stack.c:123)
>> [ 151.416299] print_report (mm/kasan/report.c:379 mm/kasan/report.c:482)
>> [ 151.416359] ? __virt_addr_valid (./include/linux/mmzone.h:2046 ./include/linux/mmzone.h:2198 arch/x86/mm/physaddr.c:54)
>> [ 151.416412] ? __futex_key_to_node (kernel/futex/core.c:349)
>> [ 151.416517] ? kasan_complete_mode_report_info (mm/kasan/report_generic.c:182)
>> [ 151.416583] ? __futex_key_to_node (kernel/futex/core.c:349)
>> [ 151.416631] kasan_report (mm/kasan/report.c:597)
>> [ 151.416677] ? __futex_key_to_node (kernel/futex/core.c:349)
>> [ 151.416732] __asan_load2 (mm/kasan/generic.c:271)
>> [ 151.416777] __futex_key_to_node (kernel/futex/core.c:349)
>> [ 151.416822] get_futex_key (kernel/futex/core.c:374 kernel/futex/core.c:386 kernel/futex/core.c:593)
>> [ 151.416871] ? __pfx_get_futex_key (kernel/futex/core.c:550)
>> [ 151.416927] futex_wake (kernel/futex/waitwake.c:165)
>> [ 151.416976] ? __pfx_futex_wake (kernel/futex/waitwake.c:156)
>> [ 151.417022] ? __pfx___x64_sys_futex_wait (kernel/futex/syscalls.c:398)
>> [ 151.417081] __x64_sys_futex_wake (kernel/futex/syscalls.c:382 kernel/futex/syscalls.c:366 kernel/futex/syscalls.c:366)
>> [ 151.417129] x64_sys_call (arch/x86/entry/syscall_64.c:41)
>> [ 151.417236] do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
>> [ 151.417342] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
>> [ 151.418312] </TASK>
>>
>> Fix by adding rcu to __mpol_put().
>>
>> change-log:
>> v2-v1: add rcu to __mpol_put
>>
>> Fixes: c042c505210d ("futex: Implement FUTEX2_MPOL")
>> Reported-by: Hao-Yu Yang <naup96721@gmail.com>
>> Signed-off-by: Hao-Yu Yang <naup96721@gmail.com>
>> ---
>> include/linux/mempolicy.h | 1 +
>> mm/mempolicy.c | 2 +-
>> 2 files changed, 2 insertions(+), 1 deletion(-)
>>
>> diff --git a/include/linux/mempolicy.h b/include/linux/mempolicy.h
>> index 0fe96f3ab3ef..65c732d440d2 100644
>> --- a/include/linux/mempolicy.h
>> +++ b/include/linux/mempolicy.h
>> @@ -55,6 +55,7 @@ struct mempolicy {
>> nodemask_t cpuset_mems_allowed; /* relative to these nodes */
>> nodemask_t user_nodemask; /* nodemask passed by user */
>> } w;
>> + struct rcu_head rcu;
>> };
>>
>> /*
>> diff --git a/mm/mempolicy.c b/mm/mempolicy.c
>> index 0e5175f1c767..6dc61a3d4a32 100644
>> --- a/mm/mempolicy.c
>> +++ b/mm/mempolicy.c
>> @@ -487,7 +487,7 @@ void __mpol_put(struct mempolicy *pol)
>> {
>> if (!atomic_dec_and_test(&pol->refcnt))
>> return;
>> - kmem_cache_free(policy_cache, pol);
>> + kfree_rcu(pol, rcu);
>> }
>> EXPORT_SYMBOL_FOR_MODULES(__mpol_put, "kvm");
>>
>> --
>> 2.34.1
>>
>
> Hi, I’d like to kindly ask if there’s an update on when this patch might be merged.
Thanks for the reminder. I'll take care of it tomorrow
Thanks,
tglx
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-03-22 21:42 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-03-13 12:47 [PATCH v2] futex: Use-after-free between futex_key_to_node_opt and vma_replace_policy Hao-Yu Yang
2026-03-21 23:57 ` Hao-Yu Yang
2026-03-22 21:42 ` Thomas Gleixner
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox