The following commit has been merged into the locking/urgent branch of tip:
Commit-ID: b61b6f95d6722ddbbbd09e689fa41b55fd36f9a5
Gitweb: https://git.kernel.org/tip/b61b6f95d6722ddbbbd09e689fa41b55fd36f9a5
Author: Peter Zijlstra <peterz@infradead.org>
AuthorDate: Fri, 11 Sep 2026 11:04:47 +02:00
Committer: Peter Zijlstra <peterz@infradead.org>
CommitterDate: Wed, 16 Sep 2026 14:20:41 +02:00
futex: Also allocate private hash on vfork()
As Jann demonstrated, it is entirely feasible to access the mm through vfork().
Therefore we need to allocate a private hash on vfork() as well as any other
CLONE_VM user.
Specifically, it must be avoided to have (private) futex waiters before
allocating the private hash.
Fixes: ee9dce44362b ("futex: Drop CLONE_THREAD requirement for private default hash alloc")
Reported-by: Jann Horn <jannh@google.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://patch.msgid.link/20260911090447.GT788244@noisy.programming.kicks-ass.net
---
kernel/fork.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/kernel/fork.c b/kernel/fork.c
index a5934a3..5ef4133 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1996,9 +1996,9 @@ static bool need_futex_hash_allocate_default(u64 clone_flags)
{
/*
* Allocate a default futex hash for any sibling that will
- * share the parent's mm, except vfork.
+ * share the parent's mm.
*/
- return (clone_flags & (CLONE_VM | CLONE_VFORK)) == CLONE_VM;
+ return clone_flags & CLONE_VM;
}
/*