Re: [PATCH v1] futex: Use-after-free between futex_key_to_node_opt and vma_replace_policy

[Hao-Yu Yang]

On Fri, Mar 13, 2026 at 01:47:23PM +0100, Eric Dumazet wrote:
> On Fri, Mar 13, 2026 at 1:42 PM Hao-Yu Yang <naup96721@xxxxxxxxx> wrote:
> >
> > On Fri, Mar 13, 2026 at 01:26:21PM +0100, Eric Dumazet wrote:
> > > On Fri, Mar 13, 2026 at 1:08 PM Hao-Yu Yang <naup96721@xxxxxxxxx> wrote:
> > > >
> > > > During futex_key_to_node_opt() execution, vma->vm_policy is read under
> > > > speculative mmap lock and RCU. Concurrently, mbind() may call
> > > > vma_replace_policy() which frees the old mempolicy immediately via
> > > > kmem_cache_free().
> > > >
> > > > This creates a race where __futex_key_to_node() dereferences a freed
> > > > mempolicy pointer, causing a use-after-free read of mpol->mode.
> > > >
> > > > patch just initial attempt to patch and need more discussion.
> > > > I think we need to remove this path or add some lock.
> > > >
> > > > Fixes: c042c505210d ("futex: Implement FUTEX2_MPOL")
> > > > Reported-by: Hao-Yu Yang <naup96721@xxxxxxxxx>
> > > > Signed-off-by: Hao-Yu Yang <naup96721@xxxxxxxxx>
> > > > ---
> > > >  kernel/futex/core.c | 23 -----------------------
> > > >  1 file changed, 23 deletions(-)
> > >
> > > Good catch !
> > >
> > > Adding rcu to __mpol_put() is really a no brainer.
> > >
> > >  Thanks.
> > >
> > > diff --git a/include/linux/mempolicy.h b/include/linux/mempolicy.h
> > > index 0fe96f3ab3ef02e902e1676e750c2006ecd6147f..65c732d440d2f4e4566204429f1e5e7487ab8f91
> > > 100644
> > > --- a/include/linux/mempolicy.h
> > > +++ b/include/linux/mempolicy.h
> > > @@ -55,6 +55,7 @@ struct mempolicy {
> > >                 nodemask_t cpuset_mems_allowed; /* relative to these nodes */
> > >                 nodemask_t user_nodemask;       /* nodemask passed by user */
> > >         } w;
> > > +       struct rcu_head rcu;
> > >  };
> > >
> > >  /*
> > > diff --git a/mm/mempolicy.c b/mm/mempolicy.c
> > > index 0e5175f1c767d81394276559b9610c24d854f5bc..6dc61a3d4a32f74a06bf005acfd82d4a43112348
> > > 100644
> > > --- a/mm/mempolicy.c
> > > +++ b/mm/mempolicy.c
> > > @@ -487,7 +487,7 @@ void __mpol_put(struct mempolicy *pol)
> > >  {
> > >         if (!atomic_dec_and_test(&pol->refcnt))
> > >                 return;
> > > -       kmem_cache_free(policy_cache, pol);
> > > +       kfree_rcu(pol, rcu);
> > >  }
> > >  EXPORT_SYMBOL_FOR_MODULES(__mpol_put, "kvm");
> >
> > Thanks for your review. I have send patch2. If this patch is good. I will cc to stable@xxxxxxxxxxxxxxx
> 
> Please, always wait ~24 hours before sending a V2, so that other
> people can chime in.
> 
> I understand you are super excited to get a patch in linux, but we are
> flooded of reports (mostly because of AI),
> so please be gentle with us.

OK, I know, thanks