From: kernel test robot <lkp@intel.com>
To: "Hao-Yu Yang" <naup96721@gmail.com>
Cc: oe-kbuild-all@lists.linux.dev, linux-kernel@vger.kernel.org,
Peter Zijlstra <peterz@infradead.org>,
Eric Dumazet <edumazet@google.com>
Subject: mm/mempolicy.c:488:6-25: WARNING: atomic_dec_and_test variation before object free at line 496.
Date: Thu, 03 Sep 2026 20:28:32 +0800 [thread overview]
Message-ID: <202609032025.W5uNU0A3-lkp@intel.com> (raw)
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: 940de590b839f71d6dc846160534bf202401b8b7
commit: 190a8c48ff623c3d67cb295b4536a660db2012aa futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy()
date: 5 months ago
config: s390-randconfig-r064-20260903 (https://download.01.org/0day-ci/archive/20260903/202609032025.W5uNU0A3-lkp@intel.com/config)
compiler: s390-linux-gcc (GCC) 8.5.0
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Fixes: 190a8c48ff62 ("futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy()")
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202609032025.W5uNU0A3-lkp@intel.com/
cocci warnings: (new ones prefixed by >>)
>> mm/mempolicy.c:488:6-25: WARNING: atomic_dec_and_test variation before object free at line 496.
vim +488 mm/mempolicy.c
^1da177e4c3f415 Linus Torvalds 2005-04-16 484
52cd3b074050dd6 Lee Schermerhorn 2008-04-28 485 /* Slow path of a mpol destructor. */
c36f6e6dff4d32e Hugh Dickins 2023-10-03 486 void __mpol_put(struct mempolicy *pol)
52cd3b074050dd6 Lee Schermerhorn 2008-04-28 487 {
c36f6e6dff4d32e Hugh Dickins 2023-10-03 @488 if (!atomic_dec_and_test(&pol->refcnt))
52cd3b074050dd6 Lee Schermerhorn 2008-04-28 489 return;
190a8c48ff623c3 Hao-Yu Yang 2026-03-13 490 /*
190a8c48ff623c3 Hao-Yu Yang 2026-03-13 491 * Required to allow mmap_lock_speculative*() access, see for example
190a8c48ff623c3 Hao-Yu Yang 2026-03-13 492 * futex_key_to_node_opt(). All accesses are serialized by mmap_lock,
190a8c48ff623c3 Hao-Yu Yang 2026-03-13 493 * however the speculative lock section unbound by the normal lock
190a8c48ff623c3 Hao-Yu Yang 2026-03-13 494 * boundaries, requiring RCU freeing.
190a8c48ff623c3 Hao-Yu Yang 2026-03-13 495 */
190a8c48ff623c3 Hao-Yu Yang 2026-03-13 @496 kfree_rcu(pol, rcu);
52cd3b074050dd6 Lee Schermerhorn 2008-04-28 497 }
f634f10809ec3d5 Shivank Garg 2025-08-27 498 EXPORT_SYMBOL_FOR_MODULES(__mpol_put, "kvm");
52cd3b074050dd6 Lee Schermerhorn 2008-04-28 499
:::::: The code at line 488 was first introduced by commit
:::::: c36f6e6dff4d32ec8b6da8f553933727a57a7a4a mempolicy trivia: slightly more consistent naming
:::::: TO: Hugh Dickins <hughd@google.com>
:::::: CC: Andrew Morton <akpm@linux-foundation.org>
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
reply other threads:[~2026-09-03 12:28 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202609032025.W5uNU0A3-lkp@intel.com \
--to=lkp@intel.com \
--cc=edumazet@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=naup96721@gmail.com \
--cc=oe-kbuild-all@lists.linux.dev \
--cc=peterz@infradead.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®