[PATCH v1] futex: Use-after-free between futex_key_to_node_opt and vma_replace_policy

[PATCH v1] futex: Use-after-free between futex_key_to_node_opt and vma_replace_policy

[Hao-Yu Yang]

During futex_key_to_node_opt() execution, vma->vm_policy is read under
speculative mmap lock and RCU. Concurrently, mbind() may call
vma_replace_policy() which frees the old mempolicy immediately via
kmem_cache_free().

This creates a race where __futex_key_to_node() dereferences a freed
mempolicy pointer, causing a use-after-free read of mpol->mode.

[  151.412631] BUG: KASAN: slab-use-after-free in __futex_key_to_node (kernel/futex/core.c:349)
[  151.414046] Read of size 2 at addr ffff888001c49634 by task e/87
[  151.414476]
[  151.415431] CPU: 1 UID: 1000 PID: 87 Comm: e Not tainted 7.0.0-rc3-g0257f64bdac7 #1 PREEMPT(lazy)
[  151.415758] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
[  151.415969] Call Trace:
[  151.416059]  <TASK>
[  151.416161]  dump_stack_lvl (lib/dump_stack.c:123)
[  151.416299]  print_report (mm/kasan/report.c:379 mm/kasan/report.c:482)
[  151.416359]  ? __virt_addr_valid (./include/linux/mmzone.h:2046 ./include/linux/mmzone.h:2198 arch/x86/mm/physaddr.c:54)
[  151.416412]  ? __futex_key_to_node (kernel/futex/core.c:349)
[  151.416517]  ? kasan_complete_mode_report_info (mm/kasan/report_generic.c:182)
[  151.416583]  ? __futex_key_to_node (kernel/futex/core.c:349)
[  151.416631]  kasan_report (mm/kasan/report.c:597)
[  151.416677]  ? __futex_key_to_node (kernel/futex/core.c:349)
[  151.416732]  __asan_load2 (mm/kasan/generic.c:271)
[  151.416777]  __futex_key_to_node (kernel/futex/core.c:349)
[  151.416822]  get_futex_key (kernel/futex/core.c:374 kernel/futex/core.c:386 kernel/futex/core.c:593)
[  151.416871]  ? __pfx_get_futex_key (kernel/futex/core.c:550)
[  151.416927]  futex_wake (kernel/futex/waitwake.c:165)
[  151.416976]  ? __pfx_futex_wake (kernel/futex/waitwake.c:156)
[  151.417022]  ? __pfx___x64_sys_futex_wait (kernel/futex/syscalls.c:398)
[  151.417081]  __x64_sys_futex_wake (kernel/futex/syscalls.c:382 kernel/futex/syscalls.c:366 kernel/futex/syscalls.c:366)
[  151.417129]  x64_sys_call (arch/x86/entry/syscall_64.c:41)
[  151.417236]  do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
[  151.417342]  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
[  151.418312]  </TASK>

I don't really know how to fix this vulnerability. So this
patch just initial attempt to patch and need more discussion.
I think we need to remove this path or add some lock.

Fixes: c042c505210d ("futex: Implement FUTEX2_MPOL")
Reported-by: Hao-Yu Yang <naup96721@gmail.com>
Signed-off-by: Hao-Yu Yang <naup96721@gmail.com>
---
 kernel/futex/core.c | 23 -----------------------
 1 file changed, 23 deletions(-)

diff --git a/kernel/futex/core.c b/kernel/futex/core.c
index cf7e610eac42..0b44fcb30268 100644
--- a/kernel/futex/core.c
+++ b/kernel/futex/core.c
@@ -362,31 +362,8 @@ static int __futex_key_to_node(struct mm_struct *mm, unsigned long addr)
 	return node;
 }
 
-static int futex_key_to_node_opt(struct mm_struct *mm, unsigned long addr)
-{
-	int seq, node;
-
-	guard(rcu)();
-
-	if (!mmap_lock_speculate_try_begin(mm, &seq))
-		return -EBUSY;
-
-	node = __futex_key_to_node(mm, addr);
-
-	if (mmap_lock_speculate_retry(mm, seq))
-		return -EAGAIN;
-
-	return node;
-}
-
 static int futex_mpol(struct mm_struct *mm, unsigned long addr)
 {
-	int node;
-
-	node = futex_key_to_node_opt(mm, addr);
-	if (node >= FUTEX_NO_NODE)
-		return node;
-
 	guard(mmap_read_lock)(mm);
 	return __futex_key_to_node(mm, addr);
 }
-- 
2.34.1

Re: [PATCH v1] futex: Use-after-free between futex_key_to_node_opt and vma_replace_policy

[Eric Dumazet]

On Fri, Mar 13, 2026 at 1:08 PM Hao-Yu Yang <naup96721@gmail.com> wrote:
>
> During futex_key_to_node_opt() execution, vma->vm_policy is read under
> speculative mmap lock and RCU. Concurrently, mbind() may call
> vma_replace_policy() which frees the old mempolicy immediately via
> kmem_cache_free().
>
> This creates a race where __futex_key_to_node() dereferences a freed
> mempolicy pointer, causing a use-after-free read of mpol->mode.
>
> patch just initial attempt to patch and need more discussion.
> I think we need to remove this path or add some lock.
>
> Fixes: c042c505210d ("futex: Implement FUTEX2_MPOL")
> Reported-by: Hao-Yu Yang <naup96721@gmail.com>
> Signed-off-by: Hao-Yu Yang <naup96721@gmail.com>
> ---
>  kernel/futex/core.c | 23 -----------------------
>  1 file changed, 23 deletions(-)

Good catch !

Adding rcu to __mpol_put() is really a no brainer.

 Thanks.

diff --git a/include/linux/mempolicy.h b/include/linux/mempolicy.h
index 0fe96f3ab3ef02e902e1676e750c2006ecd6147f..65c732d440d2f4e4566204429f1e5e7487ab8f91
100644
--- a/include/linux/mempolicy.h
+++ b/include/linux/mempolicy.h
@@ -55,6 +55,7 @@ struct mempolicy {
                nodemask_t cpuset_mems_allowed; /* relative to these nodes */
                nodemask_t user_nodemask;       /* nodemask passed by user */
        } w;
+       struct rcu_head rcu;
 };

 /*
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 0e5175f1c767d81394276559b9610c24d854f5bc..6dc61a3d4a32f74a06bf005acfd82d4a43112348
100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -487,7 +487,7 @@ void __mpol_put(struct mempolicy *pol)
 {
        if (!atomic_dec_and_test(&pol->refcnt))
                return;
-       kmem_cache_free(policy_cache, pol);
+       kfree_rcu(pol, rcu);
 }
 EXPORT_SYMBOL_FOR_MODULES(__mpol_put, "kvm");

Re: [PATCH v1] futex: Use-after-free between futex_key_to_node_opt and vma_replace_policy

[Hao-Yu Yang]

On Fri, Mar 13, 2026 at 01:26:21PM +0100, Eric Dumazet wrote:
> On Fri, Mar 13, 2026 at 1:08 PM Hao-Yu Yang <naup96721@gmail.com> wrote:
> >
> > During futex_key_to_node_opt() execution, vma->vm_policy is read under
> > speculative mmap lock and RCU. Concurrently, mbind() may call
> > vma_replace_policy() which frees the old mempolicy immediately via
> > kmem_cache_free().
> >
> > This creates a race where __futex_key_to_node() dereferences a freed
> > mempolicy pointer, causing a use-after-free read of mpol->mode.
> >
> > patch just initial attempt to patch and need more discussion.
> > I think we need to remove this path or add some lock.
> >
> > Fixes: c042c505210d ("futex: Implement FUTEX2_MPOL")
> > Reported-by: Hao-Yu Yang <naup96721@gmail.com>
> > Signed-off-by: Hao-Yu Yang <naup96721@gmail.com>
> > ---
> >  kernel/futex/core.c | 23 -----------------------
> >  1 file changed, 23 deletions(-)
> 
> Good catch !
> 
> Adding rcu to __mpol_put() is really a no brainer.
> 
>  Thanks.
> 
> diff --git a/include/linux/mempolicy.h b/include/linux/mempolicy.h
> index 0fe96f3ab3ef02e902e1676e750c2006ecd6147f..65c732d440d2f4e4566204429f1e5e7487ab8f91
> 100644
> --- a/include/linux/mempolicy.h
> +++ b/include/linux/mempolicy.h
> @@ -55,6 +55,7 @@ struct mempolicy {
>                 nodemask_t cpuset_mems_allowed; /* relative to these nodes */
>                 nodemask_t user_nodemask;       /* nodemask passed by user */
>         } w;
> +       struct rcu_head rcu;
>  };
> 
>  /*
> diff --git a/mm/mempolicy.c b/mm/mempolicy.c
> index 0e5175f1c767d81394276559b9610c24d854f5bc..6dc61a3d4a32f74a06bf005acfd82d4a43112348
> 100644
> --- a/mm/mempolicy.c
> +++ b/mm/mempolicy.c
> @@ -487,7 +487,7 @@ void __mpol_put(struct mempolicy *pol)
>  {
>         if (!atomic_dec_and_test(&pol->refcnt))
>                 return;
> -       kmem_cache_free(policy_cache, pol);
> +       kfree_rcu(pol, rcu);
>  }
>  EXPORT_SYMBOL_FOR_MODULES(__mpol_put, "kvm");

Thanks for your review. I have send patch2. If this patch is good. I will cc to stable@vger.kernel.org

Re: [PATCH v1] futex: Use-after-free between futex_key_to_node_opt and vma_replace_policy

[Eric Dumazet]

On Fri, Mar 13, 2026 at 1:42 PM Hao-Yu Yang <naup96721@gmail.com> wrote:
>
> On Fri, Mar 13, 2026 at 01:26:21PM +0100, Eric Dumazet wrote:
> > On Fri, Mar 13, 2026 at 1:08 PM Hao-Yu Yang <naup96721@gmail.com> wrote:
> > >
> > > During futex_key_to_node_opt() execution, vma->vm_policy is read under
> > > speculative mmap lock and RCU. Concurrently, mbind() may call
> > > vma_replace_policy() which frees the old mempolicy immediately via
> > > kmem_cache_free().
> > >
> > > This creates a race where __futex_key_to_node() dereferences a freed
> > > mempolicy pointer, causing a use-after-free read of mpol->mode.
> > >
> > > patch just initial attempt to patch and need more discussion.
> > > I think we need to remove this path or add some lock.
> > >
> > > Fixes: c042c505210d ("futex: Implement FUTEX2_MPOL")
> > > Reported-by: Hao-Yu Yang <naup96721@gmail.com>
> > > Signed-off-by: Hao-Yu Yang <naup96721@gmail.com>
> > > ---
> > >  kernel/futex/core.c | 23 -----------------------
> > >  1 file changed, 23 deletions(-)
> >
> > Good catch !
> >
> > Adding rcu to __mpol_put() is really a no brainer.
> >
> >  Thanks.
> >
> > diff --git a/include/linux/mempolicy.h b/include/linux/mempolicy.h
> > index 0fe96f3ab3ef02e902e1676e750c2006ecd6147f..65c732d440d2f4e4566204429f1e5e7487ab8f91
> > 100644
> > --- a/include/linux/mempolicy.h
> > +++ b/include/linux/mempolicy.h
> > @@ -55,6 +55,7 @@ struct mempolicy {
> >                 nodemask_t cpuset_mems_allowed; /* relative to these nodes */
> >                 nodemask_t user_nodemask;       /* nodemask passed by user */
> >         } w;
> > +       struct rcu_head rcu;
> >  };
> >
> >  /*
> > diff --git a/mm/mempolicy.c b/mm/mempolicy.c
> > index 0e5175f1c767d81394276559b9610c24d854f5bc..6dc61a3d4a32f74a06bf005acfd82d4a43112348
> > 100644
> > --- a/mm/mempolicy.c
> > +++ b/mm/mempolicy.c
> > @@ -487,7 +487,7 @@ void __mpol_put(struct mempolicy *pol)
> >  {
> >         if (!atomic_dec_and_test(&pol->refcnt))
> >                 return;
> > -       kmem_cache_free(policy_cache, pol);
> > +       kfree_rcu(pol, rcu);
> >  }
> >  EXPORT_SYMBOL_FOR_MODULES(__mpol_put, "kvm");
>
> Thanks for your review. I have send patch2. If this patch is good. I will cc to stable@vger.kernel.org

Please, always wait ~24 hours before sending a V2, so that other
people can chime in.

I understand you are super excited to get a patch in linux, but we are
flooded of reports (mostly because of AI),
so please be gentle with us.

Re: [PATCH v1] futex: Use-after-free between futex_key_to_node_opt and vma_replace_policy

[Hao-Yu Yang]

On Fri, Mar 13, 2026 at 01:47:23PM +0100, Eric Dumazet wrote:
> On Fri, Mar 13, 2026 at 1:42 PM Hao-Yu Yang <naup96721@gmail.com> wrote:
> >
> > On Fri, Mar 13, 2026 at 01:26:21PM +0100, Eric Dumazet wrote:
> > > On Fri, Mar 13, 2026 at 1:08 PM Hao-Yu Yang <naup96721@gmail.com> wrote:
> > > >
> > > > During futex_key_to_node_opt() execution, vma->vm_policy is read under
> > > > speculative mmap lock and RCU. Concurrently, mbind() may call
> > > > vma_replace_policy() which frees the old mempolicy immediately via
> > > > kmem_cache_free().
> > > >
> > > > This creates a race where __futex_key_to_node() dereferences a freed
> > > > mempolicy pointer, causing a use-after-free read of mpol->mode.
> > > >
> > > > patch just initial attempt to patch and need more discussion.
> > > > I think we need to remove this path or add some lock.
> > > >
> > > > Fixes: c042c505210d ("futex: Implement FUTEX2_MPOL")
> > > > Reported-by: Hao-Yu Yang <naup96721@gmail.com>
> > > > Signed-off-by: Hao-Yu Yang <naup96721@gmail.com>
> > > > ---
> > > >  kernel/futex/core.c | 23 -----------------------
> > > >  1 file changed, 23 deletions(-)
> > >
> > > Good catch !
> > >
> > > Adding rcu to __mpol_put() is really a no brainer.
> > >
> > >  Thanks.
> > >
> > > diff --git a/include/linux/mempolicy.h b/include/linux/mempolicy.h
> > > index 0fe96f3ab3ef02e902e1676e750c2006ecd6147f..65c732d440d2f4e4566204429f1e5e7487ab8f91
> > > 100644
> > > --- a/include/linux/mempolicy.h
> > > +++ b/include/linux/mempolicy.h
> > > @@ -55,6 +55,7 @@ struct mempolicy {
> > >                 nodemask_t cpuset_mems_allowed; /* relative to these nodes */
> > >                 nodemask_t user_nodemask;       /* nodemask passed by user */
> > >         } w;
> > > +       struct rcu_head rcu;
> > >  };
> > >
> > >  /*
> > > diff --git a/mm/mempolicy.c b/mm/mempolicy.c
> > > index 0e5175f1c767d81394276559b9610c24d854f5bc..6dc61a3d4a32f74a06bf005acfd82d4a43112348
> > > 100644
> > > --- a/mm/mempolicy.c
> > > +++ b/mm/mempolicy.c
> > > @@ -487,7 +487,7 @@ void __mpol_put(struct mempolicy *pol)
> > >  {
> > >         if (!atomic_dec_and_test(&pol->refcnt))
> > >                 return;
> > > -       kmem_cache_free(policy_cache, pol);
> > > +       kfree_rcu(pol, rcu);
> > >  }
> > >  EXPORT_SYMBOL_FOR_MODULES(__mpol_put, "kvm");
> >
> > Thanks for your review. I have send patch2. If this patch is good. I will cc to stable@vger.kernel.org
> 
> Please, always wait ~24 hours before sending a V2, so that other
> people can chime in.
> 
> I understand you are super excited to get a patch in linux, but we are
> flooded of reports (mostly because of AI),
> so please be gentle with us.

OK, I know, thanks