Re: [PATCH v2] futex: Use-after-free between futex_key_to_node_opt and vma_replace_policy

[Hao-Yu Yang]

So this patch is correct? What i need to do?

On Tue, Mar 24, 2026 at 03:00:19PM +0100, Peter Zijlstra wrote:
> On Mon, Mar 23, 2026 at 06:24:42PM +0100, Thomas Gleixner wrote:
> 
> > >  include/linux/mempolicy.h | 1 +
> > >  mm/mempolicy.c            | 2 +-
> > >  2 files changed, 2 insertions(+), 1 deletion(-)
> > >
> > > diff --git a/include/linux/mempolicy.h b/include/linux/mempolicy.h
> > > index 0fe96f3ab3ef..65c732d440d2 100644
> > > --- a/include/linux/mempolicy.h
> > > +++ b/include/linux/mempolicy.h
> > > @@ -55,6 +55,7 @@ struct mempolicy {
> > >  		nodemask_t cpuset_mems_allowed;	/* relative to these nodes */
> > >  		nodemask_t user_nodemask;	/* nodemask passed by user */
> > >  	} w;
> > > +	struct rcu_head rcu;
> > >  };
> > >  
> > >  /*
> > > diff --git a/mm/mempolicy.c b/mm/mempolicy.c
> > > index 0e5175f1c767..6dc61a3d4a32 100644
> > > --- a/mm/mempolicy.c
> > > +++ b/mm/mempolicy.c
> > > @@ -487,7 +487,7 @@ void __mpol_put(struct mempolicy *pol)
> > >  {
> > >  	if (!atomic_dec_and_test(&pol->refcnt))
> > >  		return;
> > > -	kmem_cache_free(policy_cache, pol);
> > > +	kfree_rcu(pol, rcu);
> > >  }
> > >  EXPORT_SYMBOL_FOR_MODULES(__mpol_put, "kvm");
> > 
> > While this looks functionally correct it is incomplete in terms of RCU.
> > 
> > The vma->vm_policy pointer needs to be marked __rcu. That then requires
> > to use rcu_dereference_check() at the reader side and
> > rcu_assign_pointer() and rcu_replace_pointer() on the writer side.
> 
> I hate that sparse annotation; it mostly just makes the code unreadable
> for then requiring those unwieldy rcu helper functions.
> 
> Not to mention we don't actually need any of that here, because:
> 
> > Especially the writer side is required so that the proper memory
> > barriers are inserted for architectures with a weakly ordered memory
> > model.
> 
> The vma->vm_policy thing is written under mmap_lock held for writing,
> and the futex consumer is a speculative read lock. Specifically the
> ordering is through the associated seqcount.
> 
> All that is really needed is to extend the lifetime of the mpol to the
> associated RCU period. Which is exactly what this patch does.
> 
> Want me to go write up a better Changelog?