From nobody Fri Oct 2 12:20:43 2026 Received: from mout.gmx.net (mout.gmx.net [212.227.17.21]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F0088222580 for ; Fri, 31 Jul 2026 15:51:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=212.227.17.21 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785513065; cv=none; b=Lxev8A5e2ApM0HD5+CkVDrnMdCDER+9b7C1dbg3HhjgCO1A3vUKBAXNGvkDzDsoOOfKltsksHurypHkXA9l/vYgfNYPv2DveRIY8RflaBbH4G01AxVfvSTEAqt/vZyK5R74CnrpbsNxFaUsPwTfZAq4VCjdn8seJ0ggHAr55J5I= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785513065; c=relaxed/simple; bh=c1kmBM3sMB3Qt4TMB2byUXVxqhckc8EzGBB3Y35C4iI=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=jUgsbpyOYOSUP7+4o7d/IJl7FLmvPtDCCRZO5wYpZ5J3L6XZNt1KKRtkrp+9XIHK51iHtnwVvfPAC8OuCB5Yk188B8uroHHIfLDi/9qV4j2TDHPUl0/DnNnVUSh3Sdcf4uS7h4B8yzmhrtAI9fR15VGBQd0zspMvI5OkfGSlPQY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=gmx.de; spf=pass smtp.mailfrom=gmx.de; dkim=pass (2048-bit key) header.d=gmx.de header.i=f3lix.dev@gmx.de header.b=LCgUEQZc; arc=none smtp.client-ip=212.227.17.21 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=gmx.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmx.de Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmx.de header.i=f3lix.dev@gmx.de header.b="LCgUEQZc" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmx.de; s=s31663417; t=1785513046; x=1786117846; i=f3lix.dev@gmx.de; bh=p1HoLU1xiNsVhdCum1tx9BzkQSTUzMqABnB7nlx4BdQ=; h=X-UI-Sender-Class:From:To:Cc:Subject:Date:Message-ID: MIME-Version:Content-Transfer-Encoding:cc: content-transfer-encoding:content-type:date:from:message-id: mime-version:reply-to:subject:to; b=LCgUEQZcVujxeDXAmTzO5uvxe6IgZ/KfXo0wy/7i97GNqlOwVF4ikWEKNyxOdjm7 +fyIS+rm+LZLQSvlJKbWYW4EnTE+nb5Anu3GTV06uf/fU9IKkaEVY1/rHNCTTbgxe sion5CO9Far5s0f/44NJHejJ+AoMMcErQgUCZRnFcPyZMw1YDst8E33rNUGeA1h4/ d/rEh/SN4EbBo4TmeSTb2kc56K1UyBy8+Y7Sfmm6n0rkJkRpWvs0WWOV3ksTCuZ5F CP7Xwq5JZFvrJf56RH30j7qU23oOHbNnVCeKZeo/n0X0dGaivcA/6pXlxVtMops+d 2nPIiYjxpDGw0XPjfg== X-UI-Sender-Class: 724b4f7f-cbec-4199-ad4e-598c01a50d3a Received: from client.hidden.invalid by mail.gmx.net (mrgmx104 [212.227.17.168]) with ESMTPSA (Nemesis) id 1MFbRm-1wijpw0xcU-000xw6; Fri, 31 Jul 2026 17:50:46 +0200 From: Felix Hoffmann To: Thomas Gleixner , Ingo Molnar Cc: Peter Zijlstra , Darren Hart , Davidlohr Bueso , =?UTF-8?q?Andr=C3=A9=20Almeida?= , Sebastian Andrzej Siewior , linux-kernel@vger.kernel.org Subject: [PATCH] futex: Avoid private hash use-after-free on final put Date: Fri, 31 Jul 2026 17:50:24 +0200 Message-ID: <20260731155024.1150011-1-f3lix.dev@gmx.de> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Provags-ID: V03:K1:YOVMHXqnqo52HUtSm01BYNfRGAkwzlKE0lxN8eFa/vJFRSKwwuT ecpIqcFwAJ606wo35kpA0bK5fkzIqOQFPl6/dyiLoO44Ttgm4swNKpAePrutCotH1wD0TSh H+r4QpOuwC4R6dBfeTC6upKEjqKqw0TCV9J4sozVrhtysXoIe/fj2gupIH5hx20OnOa20pu J5DbV1IdHxCJlyaQq2gbw== X-Spam-Flag: NO UI-OutboundReport: notjunk:1;M01:P0:h0LaVpksA4s=;/49AhcrxgJaKJUB2vUToomzxTyO xg8kQHIIY+F6uOecPxQpBTBfajuWY+aMR81mBzL1O6u2pWw1r7y5ExeqjoId2dLsaKjZIaOiZ /kfd3VRHItPQPUOWoGH5DYBwUN615HmqYJ6SRrJ5mwYoW6oTcbLWV7Jb/buGbxT464KVa6GPC FlUGwBW0rCYy4olGvQfTYv11mByaIOGcqnjNhAM6ycdbLwqtfMWpD4ok1mLqh+e9xSdxJNsnn KGj134BO19AiuvMrz/ODB0wKL9AFrUYaKdXOW4gCZtCC7aSln9Ud3W6EsZdfb3ZUHFCHZ8PQA Fsy6MoT2Y12I6mc5wFltI9pdun34I2LKxMFE0EcvZhTUCbSHKZowEHS0kLSzVxld+XnflIp0p 2Hg/NxWtAwOfYRl7fFwzmg3AnVJowTauD/HKXUerCZ6DRQXpa7/AxAuT32seg/bU/YnMi09k1 j2XsW9V6JWvACLhcg8S2fdX9UmpZ2iqtwH7sBst+N2vdtfgPtRbQgEtLEEdSguqxUO8iwd+ay DAISlk8DD2ucDEp+gJFxdw+idv95u6+LnuY+FWGhiMDQd0NaRKUy6gt24mSe4Z/iP+oFUkuvn 6S7w/f+iXDO/C44WqwhktOhHp0CQbZ7F8dWOP/HWg9nqnJ/SdM1dTejOlTSuQW1ilHl19prno ppxhpr9Tc7JzqbWYaW+umxCXMw7MyiBn8Kw92SC/gehyErAuOxGppbxfydty04pEmQ4zlFN0U rHpbWQ1N+V4kyE0p/Rdr+cBN7TYLq5ZvC7NCXuaA8XwhrS/7eXRUfuvfScv/WuMlyBUNJT05i QngE5TD/2L71hvAPJpEEj8+yVoMxrozqsHgw4F2fpsx4/k9VM+wqnB9Pab2iw++7x6BmBolio AD3nM99Eu/szri3EQuQcns8I2zijvlVMqw40A8CQ4FHbboyRah6CACD2o+MYRChSdcaEq5tMh xFzKf4rZvUfgexYIsc9u4OJWobZZCP6LSPwUm6r3kiswbt9KUW8SIaIBZpYq+TgsGcroxVcij gkNoD/1uZBe7cqd2kIKexyN8Bju1DoDFyk5HsD56DxzVm6SGbI3pDA5Sj8afdtSH/GTQifbj+ //n7GFy3YzaobkUGXuzQgS8LKug+d/GHRfJRSuR+3p9CKP5ZWR/7MOu90Q/vzWpUvPl6YHRPA veMA2xKL3SlsgcHAaz3jktcK4iqCh95oDUEdYK2hyIoEo0KVhhIY0mMhhGcYR3m8PPsbQxGFf mbopMrCfZ3NgzScXIbhZAaTq3z6fseeEJL3Du60XC1f2yA5Yxtw7FMUc5Z4PUveX5D91nr2Ou TKjTySXjEIyZ9TLbdsUR09LoCplpRV8lvhcudpNVyATo0x26oi5mLhBcx2xtv9hBjLAvxS1Oo /gcmlXzD/R1S9wVxdMZIme9siNI+tGTl6dBpZ8x7jAi1CbtUEfXzMZvL2UV/AIUXEKai/htXv wJM+fpOaurWEvWOdJBNONgEqWMIcDXGbe2lmB+0vuxm7DefpXS5DS61X9zCS0TPrbEQDZzNMH fqP/MRZQ/ZYtLr4JDlXZBy6sZap58MYKFiLbR8sNugagAooMyCiZhs5C/PlRTkDjp2M7G/mRR oJngJKYfiZx/av5phcW7voyIX4LxFmOvhN/kYZLn8987/QsWNPQBhAJBC1zqPFZXH79oOpHIA uyVRqLWIupZGGuVI0xxYj1xDy5+/jcz57C+vlZo0ELTGbNLtyr85o6+RaTpSOQVIZCYMC2rlr 7wVI57aa7zIqnaYiX28Tt+fqzf3bqQM0eOC1OWXP9Jfy3Sqje5y0vpoODucArPK6Ll0Xo3N6N 07GVtJLb8rTrL8ZsbXso+a3L3GBz0N5pAvYLJmzq7IyC5kYIVp4S0Yk1bk7XjN1hikq3c1pvU vvBGtfwqizqZmNYzvdG3AUpMwo8V1oF+DklkQJAmT3JpbMDAE0wSZFDZn1cv+5NDxiN/Y3kQq Uxra4Mp77hyI0m3qGUXjZfIo30GXvNd91t9BWTgNbIWQEvvdWKQ8PPI2+uY0eMl2TmSX0wFPX xJHCp7ocEVknLJ0OxWB3AbXudc8g7CjojI2ASctktoO8mwLtLZmlkGe1dCDNcD6vMjFxxgS2m a+uV/IMIjiS9TYRV0E/szwNH4G2iTGHkc09whOZmwvC4pGkMAvO0VaxAxumdOe4IT5oT16K9d J9z6PYMbENGKfS3LxIJJ9w0B5nq5/WF1JOBFPCQ3FpbchiBmwRGr3pv1yiZ22uK/PbBjjFwDy 5empP94zA1R8hGvPsiUGAksaICXLRhelny7f9MToFZfZUrO52KGwbCsdPOvzswBRONmtgHOWG R7CoRkTyuaZ50Q9LKDD6HvSkZXh8vwnV8cQzWVN8LFt9WyKauXGmy/IkiHB2ZjydDD0MRjgzZ YMI3swcnIrdYED4S2vBuinxonx9kH5ciHtfp9fc9qVueqqdxf3wZQL4Wep8VwnhTF4YDljAPF hN63xGJfCZbo5S2FEfI+4i5TaXss6tVW6OgzyCxJjAXPtIulIvPL27G44Jy5CS68Wb7QiWKl5 Inut4qKKtv0QOHbF6Xtq8n8zPGGA/SgEbO+zGYDaszasf3Q4Iby78E0g+mOZkLnBPDjzVkY6R KcZdPD9fXViitWDK/T1Asqe4V9QiEYH87O/7vYN3GKQ/TA2oBzwvt9P5okDuqPixjPfO+AO5R f8XD/2aFnvE7rN3glVMDReh6IGQSmy1EJYvU0pV7YM4NFCP+KoWztUM5/NwIK8xOyKppAqPkI 9fOXUekR5CIiT5zgxN9ia8qjiug67eR7nYLAhIjBRdWjThtsdbylK5C18pECWNtV9FS07jl7D MGoCbSe4xnkyKUBBqgHLDEqmHVUHbdFdPiEoMgXnRwpwJ9U8b5iT9NpAidIspc0QxQx5qVhgk aaSFHbM7pUjprPXyoUIAiuuV9QD5CFhGBMhZLQ1YBAR5fJno3g8LrXHVEkgR/Dwx5Lf3iAZ76 IT9iLYUXBaII7fF+ZnRjqyrZDUwobDGf2LmA6Z8GSaG+UwhI7qxTI3WDrNmyJvC7GFdV9WjpM z0czb39GSwtVCMJFaYAmnyhePeZ9cnXRgZ5YVpryMzgmcNQkStcMAE1+DhYSU+m786I0pldnz 8NflPvnqTAOd3ocH864Z31cZx1BA2SfwG+aOKaBtlO4bD0d0mawIpUmuU0HPy9GqcqANexkLr TNAMAVmxOdRWohSj/a67oxKiJvnvdEVgKMClgQjEDNPOWohclsTz5PhrV53JVkUrKgHxrALVx 4TunHRFBOsMKGzzBRtWgFXZdUWiiD5+Jib+0O/5/hvoRrZm16/YcIrdgmV/yzJhxOd0G+u3in DagXZRUxGGilU5s0DjN9L6tqxgp07gc5M8HWGUsp552uLFMi9SbYGxvm14FK4FlFLG/15De/F rsaOq+g3ymiWXWr9EbObdeaJU3ahp333RsmDYmFuFeW9ZQuEXG4oRgbm3kkDc22z8C09gRE4M /XSLeYCKolAk+xykGMlxq7yF+bx+00j/c1RcN8hfMCPtyTBKBtm77lkCZ3RiIuiPOBhJ5E5bs hONABFmd7JYuO1dAkIeugt/eJMLEOqLvHyhRn3yRWebJBJM8RhdUSkB3heNpy3fSMV8BZeG9T Ue/cyCpqGTBi76pAvHTosGn9s63OoZfKVSJ684CfaffB7EgObGYq89CxIS5+gC4PhTeOOaCq1 C5g0+gR/VnNTOh3w6XsKOsp0V6PD0bXpfhBKRkKbkfyAwrAt7IcKOUcwVejkrT9U9YphvxCWt Y/Ymz8RfpOrsDQ9AmwJrp4FsoWb8CAc58f+hgPrIz1+iSNddl5LAMOb8QLJ3sK6maI23jx96U dlvnJegApv2f6usOWa1t12fNTnY7Gv4lrhpUBms+iG57ihO9sDNSdjJemu8fDfFbCBbGg4GCv 1pN+1VOzQa0vdzs6hMSt4Q8eFq8Nq4W6VPFV8ytbzjfrJla7FfAyfCCyz4EkL0z2kvz4aNYxZ J8uTm9u2gTEBMtzaw8BXuwDxuAOFZol34ftrIvkOQpm94B60v+nP8ltm56ouF9oqITAL7OO18 ckNb/rgOQRaZq7FYy9J3NlIROmppEsOkz5hwuRcpV0wxYlabridqrQKvHg70azB55FQrg7Btc HNRwJ2Xu/VjJX3pjmv/xjNRF06uDskazRSRVIxmNmCREtoLYlR6bgDXBZmHpzwo7C+ELHIyWH 1XE0NJLXz/rXtzfrUQnYZodcXtR6GONY7Y8dGMnWbPkSiiDleFee0Ygsk/fRYt+26CVM3xFbh rl/tdSoagm9xxKnutDQT8jY3xAnKPxR+RrV+wZ0vOlbmOzvVkvJTx4HHK81Ham3nplg4tZ8g8 FqO7mjm0VFrfaELY+ZQeNOJ2qPZHnrkQX0qZxMd7d9Wz0RaOQTxasxZyoYMQE0YeQoJb9r5bE v8SVXazu0VKV/TRcRTjJIaZ4jKB/NphBRwPXEZ2WECzm5zAYx37WkykGlIVDTjxUMaXNRZ1JT FRUZSM24K92rRgFO3pJg2m4VojGszCgq8XkVJIvf0p3KGw6DFpk3IGrfCdzOugifrXh9u18Xy NnizB3S7Rk2bVE9TKJqjUwKO4fyd4W0DwOTyw/7J8ZSFYDGbF7uIx8Ey1YELwv1brUirpAMtx vjmeDCx/eGiKj7nif1JZTDx6D5SxRGXaTCdY4w0E4UKW61wC3aVXA/s6iBtbMPAhJB0xpiM9f pjBDDj8+HK0Pe5X843tRfTqaXpUF3hrvhlkqgEGFqa7y78AiNk2dIHGfl2Enf0ZDwpQNxKs+/ 1Nu1frALV3atE2UClW5ukrFi8Yly4Iwpupyjn/D5GqtJwuasOW0CuVUjyMIx+5UV9pj6wmnS/ hG94jeToFl+GaQDdTeHF8qzP8ZQzNmOvRD9zBsEVgo+4K+kXUbZSlL3S9zeXT353bOZpK2e2a Qy+UeV2lo4oH+CN1aIbb8Oem17g2G18AO8qcbVQ7UA+dr/jrui3qnutEPkXDm3JReu/+spZkQ oPNyWhDQajVCyexXUZzW5Mxib45VPTGISo4xha7Y/NF/jWbsBxgsRPneE8E+SWSnfhE0SFg8j 0MsMp7UBEzULngf2OVExbDcTBwHIStfBA62Jz08VpS9k34dPaaxR7XgI6Ik+b6chnr9BgH2M7 f+It7tJbc2Gk3Wp9BbPctzyFKno1vQUrBose1QHZm6LfAIQsrvf+kY2e4WhDA22rBxJhXzayV jkaqK6Po7tVs08+RTf2wI9Hzl4+4NaBsUlmysplwDUYlxYHVqkBFyjKpnboIw9l1FCfc8ORs8 c8xjWSdBEypzOCe44HZw3G6nJUUwLnPJqjFPtc3liJ/iDDyUJQOnqoEm4IpX07TmbHRvZhuj7 lO5afKnLFRwICSuALC8IvENq4zvUiMYvPlgUePerX0UETR/AIx7orfnVFnKfaEgm8d9p/4UxU CvbZeZEaRD8WtFdVtxOwXMAb1s4+qc1lnR8aUlevnyeDzh3dlQIN6C9TdQqUcyE/aGmDxMDWr eXP8kft/fppCBxOydqjor0xuGTGoq4Je/S3JrRa2esPz6Du8VWJj5eCq0XO4Wd1FOlnxuGP2i mkoUFM0FD2i4tiTwrBM6hHCHsmpmP5Z36UqTj+tEHQGgtiXs5qzc52kBrFzjWL6YmRMMb4aXB wXF1QHTPjIpxcg5EzQ27+cxfx3TLIgjQ3TUiZ0ZCzYjOfR4217Ppd2+Vlm9SNj0OENvUBnqQX VQjZz0yFjGJ9FPE6H7QOmzc2P8JzkAL2IiSJsqAGmHiXDyqehcD2mFJDHTlAxQm9zqj3gdt6g 8TnDd8SezEyZxeRXOnUXTgA8nnrR2m4I+Jz7XG71xGWQyihCUwThbvPjvQBDybbRP+VLyJqnX FE6KDt80Hkw4GKt+i2qzDkAIUcujS7RLfZKFZRzuFqCNsYDzMdRolV9cwnH2Xy1d3Sn8SLapc CjCd4s0UGHrhyngw3W9spq9Mw== Content-Type: text/plain; charset="utf-8" futex_private_hash_put() drops the reference to fph before evaluating fph->mm for wake_up_var(). futex_ref_put() enables preemption again before returning. If that put drops the final reference and the task is preempted, another task can pivot to the replacement hash and free the old hash after an RCU grace period. The first task then reads fph->mm from the freed allocation when it resumes. KASAN reports a slab-use-after-free in futex_private_hash_put(), with the read at offset 24 in a freed kmalloc-512 allocation. The allocation and free stacks point to futex_hash_allocate() and the RCU free path, respectively. Load the mm pointer while the fph reference is still held and pass the saved value to wake_up_var(). wake_up_var() uses the pointer as a waitqueue key and does not dereference the mm through it. Fixes: bd54df5ea7ca ("futex: Allow to resize the private local hash") Cc: stable@vger.kernel.org Signed-off-by: Felix Hoffmann --- Tested on mainline 8ba098e6b6ff with CONFIG_KASAN, CONFIG_PROVE_LOCKING, CONFIG_PREEMPT_DYNAMIC, and CONFIG_FUTEX_PRIVATE_HASH. The unpatched kernel reported the UAF with KASAN recording UID 65534. The exact signed commit completed a 60-second timing-amplified run with 1,278 hash resizes and 20,142 retained final-put trace events after dropping to UID/GID 65534, without a KASAN, lockdep, warning, oops, or kernel BUG report. A source reproducer is available privately on request. kernel/futex/core.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/kernel/futex/core.c b/kernel/futex/core.c index 179b26e9c934..90fa9d886f75 100644 --- a/kernel/futex/core.c +++ b/kernel/futex/core.c @@ -143,8 +143,14 @@ static bool futex_private_hash_get(struct futex_privat= e_hash *fph) =20 void futex_private_hash_put(struct futex_private_hash *fph) { - if (fph && futex_ref_put(fph)) - wake_up_var(fph->mm); + struct mm_struct *mm; + + if (!fph) + return; + + mm =3D fph->mm; + if (futex_ref_put(fph)) + wake_up_var(mm); } =20 static struct futex_hash_bucket * --=20 2.43.0