From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pg1-f181.google.com (mail-pg1-f181.google.com [209.85.215.181]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0C63C344DA8 for ; Tue, 24 Mar 2026 15:55:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.181 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774367706; cv=none; b=EkuOmKJcs0UoWInqeCtVQHCHA5qZxPzIlEsRtlYQZb51bSJeliIrBBXNnRTVkLw+MwH1dfPaqxcNSV3zZBbov+UyTpaJvsbuuccy9VOtV9RHiF+pwJCoWIUw3LYuT8rGG3Jpu0J2KHKKKIA1cpCIJDjfA2AL84U/qlJfL9gZE8A= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774367706; c=relaxed/simple; bh=CXqOzV/4R5Mr8i3FyIbDx+78v76tyzGMCEr+zzhazKE=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=eyIH8O/Sl7x37/TgHy2N1W9DO2oudukkC4cNmMjrlQgceGoBW5SX3KxN74OW32R/rkMoqUEaauCYnzx/ZNEp+bYmIrF9rUy7j4ttww97BbC0rfVaw1LsmJftLU7CPO536ihwmFYOekr9sGKMIxDrGDJu9xTrKuXlYmLzKSfYCRU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=s5WQwet6; arc=none smtp.client-ip=209.85.215.181 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="s5WQwet6" Received: by mail-pg1-f181.google.com with SMTP id 41be03b00d2f7-c7393536e53so1787552a12.2 for ; Tue, 24 Mar 2026 08:55:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1774367704; x=1774972504; darn=vger.kernel.org; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=AADFUoq/x8dJnaFKMGvyyjEOCGHhgTDn8qBc2nRaMNg=; b=s5WQwet6asXflWz0wGIDF9DlOnYr7nxPnksm41ePBGJsc//Vz5CuHZK+t1OQ237PMd B4oL2PQjNGrIJ1LsIXIYe39PzXsirhrC+jY+iq75LOjLbD84cxhhvXj+l90GkfLHhwdj mcZQ86vMH3usZG7wqpLJO5DzPgmFVZaqCF9KDg2DceDxuHDuF+X0gd+doBqfi5YoA84+ Qhfcb4Xms39zwLhZaTiqTUYcbDe9Dt1pk6V9f5elNHvNkfs445VzjL8A95neZAYBNnJW FM0z/JsyOS/+fA5cmlGXA7UXbWV/5LGGaDK4FJYQJedjXCjQZdVVHfFjvbJGmSxOYrAx 8qDw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1774367704; x=1774972504; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-gg:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=AADFUoq/x8dJnaFKMGvyyjEOCGHhgTDn8qBc2nRaMNg=; b=kKWOkoa5LGfjrXa8XcQzaE3TGieQPCD2lADBEuuJxtoBkU0BzXqByYrQeFKaavigo4 qm68rKQm0NxlKE9904z4DBQrush0IHwAb5MDJbdbdTuWIoDUSHINHSzy7IWAEx+7y8c/ AxZHhE7SLFh2pR+7wC5B04zo5aKYjvyxCFs/Cq+Q2TMVcZShS2MKxh3w7DuY5YGVFOVu e3rotseHIV7t2yOHcEFZijD86SX2NDZVAQHkBsqPvhjCJAkJdLExlGaOQLVK1lvs6yf5 vI32BIW3gfzCU22eSbdrMbf/NEzYfbGrgXBTzCcNtceO+Zku0UZKyE8BeR1JnBzAuQBt 5RIg== X-Forwarded-Encrypted: i=1; AJvYcCUOCIatF/fVU1R3o6Z8uVzmzKqiomopwkVty9fRiob7Nup6lZ8Z9oeHF7A24JfgqSBd5j88pUL/U8nDaQ4=@vger.kernel.org X-Gm-Message-State: AOJu0Yz6X0g2jbeVuedU9a431Q8+UbN7RB1m9PDNvipmSTNKw9wXTrcP dD2/pcFShNr4HSsRYCFOUn7Le1fOfVobUUAso9AvZLuDpfj9Wyn6qtnR X-Gm-Gg: ATEYQzx8d0BK8FsB8Xeb8ke4I6Y/I8Z3TJs/e/nQLxB31f59DxmqeyTCi7KBFn/dSjQ G1RK6uORk2acxMPCtg9YrvxBReXJiYZKPiz6BmhgOIX9grCmU9MrUiEZZ52f0p3kb8GR4BWQ1vJ nOeaBb3l9YxLbMSHsjlM4yuOKczBGg5qYfKIA/OE/0wCM2F1WR+7qiclkSqh4sjOrJ9BywVYjkH wjDASog4fMc3rILmoXrOGg3w/uFffhApqD2XfoduYmU8SYRGBYvMVHTP9GtSBsVbv4IK17q9X9W UOVoKrp8gD332zohP+tOBVS64hg3qMExLcj8I08cT/ssAVBx5xuOYfS1a0q1njosWlHeTCOFtcc H0+YOUKM7LeOHi3Yo0oYO30GxmzREhHavJdRtRfQFhUJ0X1fMeeA2KCRvENqDeASaTnq1jFy1jn sGMaZnEF0FcADK7tTzPYDHOcJg+cOB/1MSHXHJlUNoIAgjZHSF X-Received: by 2002:a17:903:182:b0:2ae:5163:c2aa with SMTP id d9443c01a7336-2b0b0a6a8demr1383605ad.20.1774367704153; Tue, 24 Mar 2026 08:55:04 -0700 (PDT) Received: from naup-virtual-machine ([140.113.92.221]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2b0adcf1b4fsm12618935ad.83.2026.03.24.08.55.01 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 24 Mar 2026 08:55:03 -0700 (PDT) Date: Tue, 24 Mar 2026 23:54:59 +0800 From: Hao-Yu Yang To: Peter Zijlstra Cc: Thomas Gleixner , mingo@redhat.com, linux-kernel@vger.kernel.org, Andrew Morton , David Hillenbrand , Eric Dumazet , linux-mm@kvack.org Subject: Re: [PATCH v2] futex: Use-after-free between futex_key_to_node_opt and vma_replace_policy Message-ID: References: <20260313124756.52461-1-naup96721@gmail.com> <87a4vyihlx.ffs@tglx> <20260324140019.GE3738010@noisy.programming.kicks-ass.net> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260324140019.GE3738010@noisy.programming.kicks-ass.net> So this patch is correct? What i need to do? On Tue, Mar 24, 2026 at 03:00:19PM +0100, Peter Zijlstra wrote: > On Mon, Mar 23, 2026 at 06:24:42PM +0100, Thomas Gleixner wrote: > > > > include/linux/mempolicy.h | 1 + > > > mm/mempolicy.c | 2 +- > > > 2 files changed, 2 insertions(+), 1 deletion(-) > > > > > > diff --git a/include/linux/mempolicy.h b/include/linux/mempolicy.h > > > index 0fe96f3ab3ef..65c732d440d2 100644 > > > --- a/include/linux/mempolicy.h > > > +++ b/include/linux/mempolicy.h > > > @@ -55,6 +55,7 @@ struct mempolicy { > > > nodemask_t cpuset_mems_allowed; /* relative to these nodes */ > > > nodemask_t user_nodemask; /* nodemask passed by user */ > > > } w; > > > + struct rcu_head rcu; > > > }; > > > > > > /* > > > diff --git a/mm/mempolicy.c b/mm/mempolicy.c > > > index 0e5175f1c767..6dc61a3d4a32 100644 > > > --- a/mm/mempolicy.c > > > +++ b/mm/mempolicy.c > > > @@ -487,7 +487,7 @@ void __mpol_put(struct mempolicy *pol) > > > { > > > if (!atomic_dec_and_test(&pol->refcnt)) > > > return; > > > - kmem_cache_free(policy_cache, pol); > > > + kfree_rcu(pol, rcu); > > > } > > > EXPORT_SYMBOL_FOR_MODULES(__mpol_put, "kvm"); > > > > While this looks functionally correct it is incomplete in terms of RCU. > > > > The vma->vm_policy pointer needs to be marked __rcu. That then requires > > to use rcu_dereference_check() at the reader side and > > rcu_assign_pointer() and rcu_replace_pointer() on the writer side. > > I hate that sparse annotation; it mostly just makes the code unreadable > for then requiring those unwieldy rcu helper functions. > > Not to mention we don't actually need any of that here, because: > > > Especially the writer side is required so that the proper memory > > barriers are inserted for architectures with a weakly ordered memory > > model. > > The vma->vm_policy thing is written under mmap_lock held for writing, > and the futex consumer is a speculative read lock. Specifically the > ordering is through the associated seqcount. > > All that is really needed is to extend the lifetime of the mpol to the > associated RCU period. Which is exactly what this patch does. > > Want me to go write up a better Changelog?