Hao-Yu Yang 190a8c48ff futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() ... During futex_key_to_node_opt() execution, vma->vm_policy is read under speculative mmap lock and RCU. Concurrently, mbind() may call vma_replace_policy() which frees the old mempolicy immediately via kmem_cache_free(). This creates a race where __futex_key_to_node() dereferences a freed mempolicy pointer, causing a use-after-free read of mpol->mode. [ 151.412631] BUG: KASAN: slab-use-after-free in __futex_key_to_node (kernel/futex/core.c:349) [ 151.414046] Read of size 2 at addr ffff888001c49634 by task e/87 [ 151.415969] Call Trace: [ 151.416732] __asan_load2 (mm/kasan/generic.c:271) [ 151.416777] __futex_key_to_node (kernel/futex/core.c:349) [ 151.416822] get_futex_key (kernel/futex/core.c:374 kernel/futex/core.c:386 kernel/futex/core.c:593) Fix by adding rcu to __mpol_put(). Fixes: c042c50521 ("futex: Implement FUTEX2_MPOL") Reported-by: Hao-Yu Yang <naup96721@gmail.com> Suggested-by: Eric Dumazet <edumazet@google.com> Signed-off-by: Hao-Yu Yang <naup96721@gmail.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Eric Dumazet <edumazet@google.com> Acked-by: David Hildenbrand (Arm) <david@kernel.org> Link: https://patch.msgid.link/20260324174418.GB1850007@noisy.programming.kicks-ass.net		2026-03-26 16:13:48 +01:00
..
bpf	bpf: Fix sync_linked_regs regarding BPF_ADD_CONST32 zext propagation	2026-03-21 13:19:40 -07:00
cgroup	cgroup: Don't expose dead tasks in cgroup	2026-03-06 12:43:25 -10:00
configs	Remove WARN_ALL_UNSEEDED_RANDOM kernel config option	2026-02-23 11:18:48 -08:00
debug	treewide: Replace kmalloc with kmalloc_obj for non-scalar types	2026-02-21 01:02:28 -08:00
dma	dma-mapping: avoid random addr value print out on error path	2026-02-23 08:26:54 +01:00
entry	Merge branch 'core/entry' into sched/core	2026-01-30 15:40:05 +01:00
events	perf: Make sure to use pmu_ctx->pmu for groups	2026-03-12 11:29:16 +01:00
futex	futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy()	2026-03-26 16:13:48 +01:00
gcov	Convert more 'alloc_obj' cases to default GFP_KERNEL arguments	2026-02-21 20:03:00 -08:00
irq	Convert 'alloc_flex' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
kcsan	kcsan: test: Adjust "expect" allocation type for kmalloc_obj	2026-02-26 09:54:08 -08:00
livepatch	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
liveupdate	liveupdate: luo_file: remember retrieve() status	2026-02-24 11:13:26 -08:00
locking	Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses	2026-02-22 08:26:33 -08:00
module	module: Fix kernel panic when a symbol st_shndx is out of bounds	2026-02-23 19:37:28 +00:00
power	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
printk	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
rcu	Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses	2026-02-22 08:26:33 -08:00
sched	sched: idle: Consolidate the handling of two special cases	2026-03-16 20:29:47 +01:00
time	time/jiffies: Mark jiffies_64_to_clock_t() notrace	2026-03-11 10:33:12 +01:00
trace	ftrace: Use hash argument for tmp_ops in update_ftrace_direct_mod	2026-03-21 16:51:04 -04:00
unwind	Convert more 'alloc_obj' cases to default GFP_KERNEL arguments	2026-02-21 20:03:00 -08:00
.gitignore	…
Kconfig.freezer	…
Kconfig.hz	…
Kconfig.kexec	…
Kconfig.locks	…
Kconfig.preempt	sched: Further restrict the preemption modes	2026-01-08 12:43:57 +01:00
Makefile	kcov: Enable context analysis	2026-01-05 16:43:34 +01:00
acct.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
async.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
audit.c	Convert 'alloc_flex' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
audit.h	…
audit_fsnotify.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
audit_tree.c	Convert 'alloc_flex' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
audit_watch.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
auditfilter.c	Convert 'alloc_flex' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
auditsc.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
backtracetest.c	…
bounds.c	…
capability.c	…
cfi.c	…
compat.c	…
configs.c	…
context_tracking.c	context_tracking: Remove rcu_task_trace_heavyweight_{enter,exit}()	2026-01-01 16:39:46 +08:00
cpu.c	SPDX updates for 7.0-rc1	2026-02-17 09:46:03 -08:00
cpu_pm.c	…
crash_core.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
crash_core_test.c	…
crash_dump_dm_crypt.c	crash_dump: don't log dm-crypt key bytes in read_key_from_user_keying	2026-03-10 16:01:48 -07:00
crash_reserve.c	…
cred.c	cred: remove unused set_security_override_from_ctx()	2026-01-06 20:52:57 -05:00
delayacct.c	delayacct: fix uapi timespec64 definition	2026-02-08 00:13:32 -08:00
dma.c	…
elfcorehdr.c	…
exec_domain.c	…
exit.c	kthread: consolidate kthread exit paths to prevent use-after-free	2026-02-26 10:45:49 +01:00
exit.h	…
extable.c	…
fail_function.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
fork.c	sched/mmcid: Avoid full tasklist walks	2026-03-11 12:01:07 +01:00
freezer.c	…
gen_kheaders.sh	…
groups.c	treewide: Replace kmalloc with kmalloc_obj for non-scalar types	2026-02-21 01:02:28 -08:00
hung_task.c	…
iomem.c	…
irq_work.c	…
jump_label.c	…
kallsyms.c	mm.git review status for linus..mm-nonmm-stable	2026-02-12 12:13:01 -08:00
kallsyms_internal.h	kallsyms: Get rid of kallsyms relative base	2026-01-22 15:58:22 -07:00
kallsyms_selftest.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
kallsyms_selftest.h	…
kcmp.c	…
kcov.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
kexec.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
kexec_core.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
kexec_elf.c	…
kexec_file.c	kexec: derive purgatory entry from symbol	2026-01-31 16:16:07 -08:00
kexec_internal.h	…
kheaders.c	…
kprobes.c	kprobes: Remove unneeded warnings from __arm_kprobe_ftrace()	2026-03-13 23:15:26 +09:00
kstack_erase.c	…
ksyms_common.c	…
ksysfs.c	…
kthread.c	kthread: consolidate kthread exit paths to prevent use-after-free	2026-02-26 10:45:49 +01:00
latencytop.c	…
module_signature.c	…
notifier.c	…
nscommon.c	nsfs: tighten permission checks for ns iteration ioctls	2026-02-27 22:00:08 +01:00
nsproxy.c	…
nstree.c	nstree: tighten permission checks for listing	2026-02-27 22:00:11 +01:00
padata.c	Convert more 'alloc_obj' cases to default GFP_KERNEL arguments	2026-02-21 20:03:00 -08:00
panic.c	panic: add panic_force_cpu= parameter to redirect panic to a specific CPU	2026-02-03 08:21:26 -08:00
params.c	Convert more 'alloc_obj' cases to default GFP_KERNEL arguments	2026-02-21 20:03:00 -08:00
pid.c	Revert "pid: make __task_pid_nr_ns(ns => NULL) safe for zombie callers"	2026-02-10 11:39:30 +01:00
pid_namespace.c	…
pid_sysctl.h	…
profile.c	…
ptrace.c	…
range.c	…
reboot.c	treewide: Replace kmalloc with kmalloc_obj for non-scalar types	2026-02-21 01:02:28 -08:00
regset.c	…
relay.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
resource.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
resource_kunit.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
rseq.c	rseq: slice ext: Ensure rseq feature size differs from original rseq size	2026-02-23 11:19:19 +01:00
scftorture.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
scs.c	…
seccomp.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
signal.c	compiler-context-analysis: Remove __cond_lock() function-like helper	2026-01-05 16:43:33 +01:00
smp.c	…
smpboot.c	…
smpboot.h	…
softirq.c	…
stacktrace.c	…
static_call.c	…
static_call_inline.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
stop_machine.c	…
sys.c	RISC-V updates for v7.0	2026-02-12 19:17:44 -08:00
sys_ni.c	rseq: Implement sys_rseq_slice_yield()	2026-01-22 11:11:17 +01:00
sysctl-test.c	…
sysctl.c	sysctl: replace SYSCTL_INT_CONV_CUSTOM macro with functions	2026-01-06 11:27:10 +01:00
task_work.c	…
taskstats.c	…
torture.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
tracepoint.c	Convert 'alloc_flex' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
tsacct.c	tsacct: skip all kernel threads	2026-01-26 19:07:13 -08:00
ucount.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
uid16.c	…
uid16.h	…
umh.c	treewide: Replace kmalloc with kmalloc_obj for non-scalar types	2026-02-21 01:02:28 -08:00
up.c	…
user-return-notifier.c	…
user.c	…
user_namespace.c	Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses	2026-02-22 08:26:33 -08:00
utsname.c	…
utsname_sysctl.c	…
vhost_task.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
vmcore_info.c	mm.git review status for linus..mm-nonmm-stable	2026-02-12 12:13:01 -08:00
watch_queue.c	Convert 'alloc_flex' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
watchdog.c	watchdog/softlockup: fix sample ring index wrap in need_counting_irqs()	2026-02-08 00:13:34 -08:00
watchdog_buddy.c	…
watchdog_perf.c	watchdog/hardlockup: simplify perf event probe and remove per-cpu dependency	2026-02-08 00:13:35 -08:00
workqueue.c	workqueue: Rename show_cpu_pool{s,}_hog{s,}() to reflect broadened scope	2026-03-06 06:38:16 -10:00
workqueue_internal.h	workqueue: Show in-flight work item duration in stall diagnostics	2026-03-05 07:27:48 -10:00