From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from casper.infradead.org (casper.infradead.org [90.155.50.34]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A96D72DE6F1 for ; Tue, 24 Mar 2026 14:00:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=90.155.50.34 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774360831; cv=none; b=f/MdVXikVoqkfCohptfl41Du+nFpoxg63Zv9nw8xTGHDwnvwWOoQwgLzrSzNm2BgKELbZf7TkCT7ffAwFqbXqX4U96+DZhrowMlF1QeSBagd0Jo40oNjTY7AMjirbgxbIFdaQLzEKZef5z+j/LlN4DieFOYBGKV8sRosqCCBToM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774360831; c=relaxed/simple; bh=Y9HFwqSo2zv1jdJjQJrcAr/LrxMUXJe3p5sutCSTZYU=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=hF/2Y2mdPfqH502QgBqLBQBwYPJnREyPXA6PBY34SCn5zAFDB0xZoeoI/wBRnfK48ehPxB5RkPB9BZk5Thwi2XxylCp1wBgD7ZjYat1YacmD4LLo4RDstFH/JjN/wfITAFzL9KTjFB5fxL1D3DdKlRIQXEmoNN8Gu2HhG0vvpwY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=infradead.org; spf=none smtp.mailfrom=infradead.org; dkim=pass (2048-bit key) header.d=infradead.org header.i=@infradead.org header.b=kFyY/uY1; arc=none smtp.client-ip=90.155.50.34 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=infradead.org Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=infradead.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=infradead.org header.i=@infradead.org header.b="kFyY/uY1" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=casper.20170209; h=In-Reply-To:Content-Type:MIME-Version: References:Message-ID:Subject:Cc:To:From:Date:Sender:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description; bh=vYpp2zd5bcLpLRUxBdcr0PV/kjzDh6+TBXbgdTt5jQI=; b=kFyY/uY158fZq2yziSCwUz8cGR JR31T9nU/ZTUO7vPnLar/NCR8LsfKJArPicR8AjDdfzEdn/6b5DkBQ4ee9DXr+ZIRQoSDgaC92U37 E1jZleAqjCOwSLAckrOmK5vFtaKio9eOEQ7V91XBn6a/z90SZtAyoy65nYc9RSQBecpxezUmtXJqJ RH6+lWQmq0po1ZrWWXt8wdpX9MD4rv4x1n077CeK0ixMoQPfwUY54i2uYr1vg+tDMjI/pEIvj2KhT RaumJ9FJjmZ8L5jB17PLuv7zslB+pGZlOzV3mkpKO8aASdPyf1zLUh9Q95SOTV2yz+ZjtXT//Qvfo NzIYGZvQ==; Received: from 2001-1c00-8d85-5700-266e-96ff-fe07-7dcc.cable.dynamic.v6.ziggo.nl ([2001:1c00:8d85:5700:266e:96ff:fe07:7dcc] helo=noisy.programming.kicks-ass.net) by casper.infradead.org with esmtpsa (Exim 4.98.2 #2 (Red Hat Linux)) id 1w52Iv-0000000E7T4-23HU; Tue, 24 Mar 2026 14:00:21 +0000 Received: by noisy.programming.kicks-ass.net (Postfix, from userid 1000) id C1BF53002D8; Tue, 24 Mar 2026 15:00:19 +0100 (CET) Date: Tue, 24 Mar 2026 15:00:19 +0100 From: Peter Zijlstra To: Thomas Gleixner Cc: Hao-Yu Yang , mingo@redhat.com, linux-kernel@vger.kernel.org, Andrew Morton , David Hillenbrand , Eric Dumazet , linux-mm@kvack.org Subject: Re: [PATCH v2] futex: Use-after-free between futex_key_to_node_opt and vma_replace_policy Message-ID: <20260324140019.GE3738010@noisy.programming.kicks-ass.net> References: <20260313124756.52461-1-naup96721@gmail.com> <87a4vyihlx.ffs@tglx> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <87a4vyihlx.ffs@tglx> On Mon, Mar 23, 2026 at 06:24:42PM +0100, Thomas Gleixner wrote: > > include/linux/mempolicy.h | 1 + > > mm/mempolicy.c | 2 +- > > 2 files changed, 2 insertions(+), 1 deletion(-) > > > > diff --git a/include/linux/mempolicy.h b/include/linux/mempolicy.h > > index 0fe96f3ab3ef..65c732d440d2 100644 > > --- a/include/linux/mempolicy.h > > +++ b/include/linux/mempolicy.h > > @@ -55,6 +55,7 @@ struct mempolicy { > > nodemask_t cpuset_mems_allowed; /* relative to these nodes */ > > nodemask_t user_nodemask; /* nodemask passed by user */ > > } w; > > + struct rcu_head rcu; > > }; > > > > /* > > diff --git a/mm/mempolicy.c b/mm/mempolicy.c > > index 0e5175f1c767..6dc61a3d4a32 100644 > > --- a/mm/mempolicy.c > > +++ b/mm/mempolicy.c > > @@ -487,7 +487,7 @@ void __mpol_put(struct mempolicy *pol) > > { > > if (!atomic_dec_and_test(&pol->refcnt)) > > return; > > - kmem_cache_free(policy_cache, pol); > > + kfree_rcu(pol, rcu); > > } > > EXPORT_SYMBOL_FOR_MODULES(__mpol_put, "kvm"); > > While this looks functionally correct it is incomplete in terms of RCU. > > The vma->vm_policy pointer needs to be marked __rcu. That then requires > to use rcu_dereference_check() at the reader side and > rcu_assign_pointer() and rcu_replace_pointer() on the writer side. I hate that sparse annotation; it mostly just makes the code unreadable for then requiring those unwieldy rcu helper functions. Not to mention we don't actually need any of that here, because: > Especially the writer side is required so that the proper memory > barriers are inserted for architectures with a weakly ordered memory > model. The vma->vm_policy thing is written under mmap_lock held for writing, and the futex consumer is a speculative read lock. Specifically the ordering is through the associated seqcount. All that is really needed is to extend the lifetime of the mpol to the associated RCU period. Which is exactly what this patch does. Want me to go write up a better Changelog?