futex: Fix private hash use-after-free on resize

PATCH Applied Chris Mason 3 participants 3 messages Oct 1 – Oct 2 Futex

Share & tools

Chris Mason

author

2026-10-01 13:50 UTC #0 lore raw

PATCH v2 1/1 futex: Fix private hash use-after-free on resize

poll_state_synchronize_rcu(mm->futex.phash.batches) is used by futex_ref_drop() to check that a grace period has passed since the current hash was published. This relies on batches referencing a grace period which started after the hash pointer was assigned.

__futex_pivot_hash() sets mmph->batches before it replaces mmph->hash:

    scoped_guard(rcu) {
            mmph->batches = get_state_synchronize_rcu();
            rcu_assign_pointer(mmph->hash, new);
    }

The scoped_guard(rcu) doesn't stop new grace periods from starting, and if one starts between those two assignments, futex_ref_drop() can move forward while a reader still holds a pointer to the old hash.

Fix things by setting mmph->batches after assigning mmph->hash. The scoped_guard(rcu) isn't needed, so let's drop that as well.

Fixes 56180dd20c19 ("futex: Use RCU-based per-CPU reference counting instead of rcuref_t")

Assisted-by kres

Signed-off-by Chris Mason <[email protected]>

---
 kernel/futex/core.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

kernel/futex/core.c +6 -4

index a061f54b606d..095f9fe440e3 100644
@@ -213,10 +213,12 @@ static bool __futex_pivot_hash(struct mm_struct *mm, struct futex_private_hash *
 		futex_rehash_private(fph, new);
 	}
 	new->state = FR_PERCPU;
-	scoped_guard(rcu) {
-		mmph->batches = get_state_synchronize_rcu();
-		rcu_assign_pointer(mmph->hash, new);
-	}
+	rcu_assign_pointer(mmph->hash, new);
+	/*
+	 * mmph->batches must reference a grace period which started after
+	 * mmph->hash was assigned. See futex_ref_drop().
+	 */
+	mmph->batches = get_state_synchronize_rcu();
 	kvfree_rcu(fph, rcu);
 	return true;
 }

Signature · 1 line

2.54.0

Paul E. McKenney

Reviewed-by on v2 1/1

2026-10-01 17:16 UTC #1 lore raw

Quoted 16 lines · Chris Mason

poll_state_synchronize_rcu(mm->futex.phash.batches) is used by futex_ref_drop() to check that a grace period has passed since the current hash was published. This relies on batches referencing a grace period which started after the hash pointer was assigned.
__futex_pivot_hash() sets mmph->batches before it replaces mmph->hash:
    scoped_guard(rcu) {
            mmph->batches = get_state_synchronize_rcu();
            rcu_assign_pointer(mmph->hash, new);
    }
The scoped_guard(rcu) doesn't stop new grace periods from starting, and if one starts between those two assignments, futex_ref_drop() can move forward while a reader still holds a pointer to the old hash.

Quoted 6 lines

Fix things by setting mmph->batches after assigning mmph->hash. The scoped_guard(rcu) isn't needed, so let's drop that as well.
Fixes 56180dd20c19 ("futex: Use RCU-based per-CPU reference counting instead of rcuref_t")
Assisted-by kres
Signed-off-by Chris Mason <[email protected]>

From an RCU perspective:

Reviewed-by Paul E. McKenney <[email protected]>

Quoted 28 lines

---
 kernel/futex/core.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

kernel/futex/core.c +6 -4

index a061f54b606d..095f9fe440e3 100644
@@ -213,10 +213,12 @@ static bool __futex_pivot_hash(struct mm_struct *mm, struct futex_private_hash *
 		futex_rehash_private(fph, new);
 	}
 	new->state = FR_PERCPU;
-	scoped_guard(rcu) {
-		mmph->batches = get_state_synchronize_rcu();
-		rcu_assign_pointer(mmph->hash, new);
-	}
+	rcu_assign_pointer(mmph->hash, new);
+	/*
+	 * mmph->batches must reference a grace period which started after
+	 * mmph->hash was assigned. See futex_ref_drop().
+	 */
+	mmph->batches = get_state_synchronize_rcu();
 	kvfree_rcu(fph, rcu);
 	return true;
 }

Signature · 1 line

2.54.0

tip-bot2 for Chris Mason

merge bot Applied

2026-10-02 09:49 UTC #2 lore raw

In reply to Chris Mason

The following commit has been merged into the locking/urgent branch of tip:

Commit-ID:     f35e3b5784221654f9cdbd6222275a7fa203f6c3
Gitweb:        https://git.kernel.org/tip/f35e3b5784221654f9cdbd6222275a7fa203f6c3
Author:        Chris Mason <[email protected]>
AuthorDate:    Thu, 01 Oct 2026 13:50:22 
Committer:     Peter Zijlstra <[email protected]>
CommitterDate: Fri, 02 Oct 2026 11:47:13 +02:00

futex: Fix private hash use-after-free on resize

__futex_pivot_hash() sets mmph->batches before it replaces mmph->hash:

    scoped_guard(rcu) {
            mmph->batches = get_state_synchronize_rcu();
            rcu_assign_pointer(mmph->hash, new);
    }

Fix things by setting mmph->batches after assigning mmph->hash. The scoped_guard(rcu) isn't needed, so let's drop that as well.

Fixes 56180dd20c19 ("futex: Use RCU-based per-CPU reference counting instead of rcuref_t")

Assisted-by kres

Signed-off-by Chris Mason <[email protected]>

Signed-off-by Peter Zijlstra (Intel) <[email protected]>

Reviewed-by Paul E. McKenney <[email protected]>

Link https://patch.msgid.link/[email protected] open here

---
 kernel/futex/core.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

kernel/futex/core.c +6 -4

index a061f54..095f9fe 100644
@@ -213,10 +213,12 @@ static bool __futex_pivot_hash(struct mm_struct *mm, struct futex_private_hash *
 		futex_rehash_private(fph, new);
 	}
 	new->state = FR_PERCPU;
-	scoped_guard(rcu) {
-		mmph->batches = get_state_synchronize_rcu();
-		rcu_assign_pointer(mmph->hash, new);
-	}
+	rcu_assign_pointer(mmph->hash, new);
+	/*
+	 * mmph->batches must reference a grace period which started after
+	 * mmph->hash was assigned. See futex_ref_drop().
+	 */
+	mmph->batches = get_state_synchronize_rcu();
 	kvfree_rcu(fph, rcu);
 	return true;
 }