From 59b3732f95dda1fbd2234514d35f4fb6b5bb6d85 Mon Sep 17 00:00:00 2001 From: Kyle Zeng Date: Fri, 7 Aug 2026 17:07:03 +0200 Subject: [PATCH] futex/pi: Reject cross-mm private futex owners A private futex key borrows the waiter's mm without taking an mm_users reference. Nevertheless, attach_to_pi_owner() currently accepts an owner from a different address space and copies the private key into the owner's PI state. When that owner exits, exit_pi_state_list() uses the saved key to find the hash bucket and acquires a reference to the waiter's private hash. If the last user of the waiter's mm exits concurrently, futex_hash_free() frees the hash while the owner still uses its bucket and reference. Prevent this by validating in attach_to_pi_owner() that, for private futexes, the owner mm and waiter mm are the same. Perform the check with the owner's pi_lock held and after validating owner::futex::state to serialize against a concurrent PI-state exit cleanup. [ tglx: Amended comment ] Fixes: 80367ad01d93 ("futex: Add basic infrastructure for local task local hash") Signed-off-by: Kyle Zeng Signed-off-by: Thomas Gleixner Acked-by: Peter Zijlstra Assisted-by: Codex:gpt-5.6-sol Cc: stable@vger.kernel.org --- kernel/futex/pi.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/kernel/futex/pi.c b/kernel/futex/pi.c index 795011ea1202..3e277ef155cd 100644 --- a/kernel/futex/pi.c +++ b/kernel/futex/pi.c @@ -465,6 +465,26 @@ static int attach_to_pi_owner(u32 __user *uaddr, u32 uval, union futex_key *key, return ret; } + /* + * If the owner is about to exit() or exec() and tries to modify + * p::futex::exit_state it is serialized against this code by + * p::pi_lock. + */ + if (IS_ENABLED(CONFIG_MMU) && futex_key_is_private(key)) { + /* + * A private futex key holds a pointer to the waiter's mm + * without holding a reference on it. So it must not be attached + * to an owner in a different address space. Otherwise that + * owner's exit cleanup could access the private hash after the + * key's mm is freed. + */ + if (unlikely(p->mm != key->private.mm)) { + raw_spin_unlock_irq(&p->pi_lock); + put_task_struct(p); + return -EPERM; + } + } + __attach_to_pi_owner(p, key, ps); raw_spin_unlock_irq(&p->pi_lock);