diff options
| author | Sebastian Andrzej Siewior <bigeasy@linutronix.de> | 2025-06-23 10:34:08 +0200 |
|---|---|---|
| committer | Peter Zijlstra <peterz@infradead.org> | 2025-06-23 14:50:37 +0200 |
| commit | a24cc6ce1933eade12aa2b9859de0fcd2dac2c06 (patch) | |
| tree | 9c537c581261c9995b89e8cd77d4a8eb7c896bc0 | |
| parent | 86731a2a651e58953fc949573895f2fa6d456841 (diff) | |
futex: Initialize futex_phash_new during fork().
During a hash resize operation the new private hash is stored in
mm_struct::futex_phash_new if the current hash can not be immediately
replaced.
The new hash must not be copied during fork() into the new task. Doing
so will lead to a double-free of the memory by the two tasks.
Initialize the mm_struct::futex_phash_new during fork().
Closes: https://lore.kernel.org/all/aFBQ8CBKmRzEqIfS@mozart.vkv.me/
Fixes: bd54df5ea7cad ("futex: Allow to resize the private local hash")
Reported-by: Calvin Owens <calvin@wbinvd.org>
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Tested-by: Calvin Owens <calvin@wbinvd.org>
Link: https://lkml.kernel.org/r/20250623083408.jTiJiC6_@linutronix.de
| -rw-r--r-- | include/linux/futex.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/include/linux/futex.h b/include/linux/futex.h index 005b040c4791..b37193653e6b 100644 --- a/include/linux/futex.h +++ b/include/linux/futex.h @@ -89,6 +89,7 @@ void futex_hash_free(struct mm_struct *mm); static inline void futex_mm_init(struct mm_struct *mm) { RCU_INIT_POINTER(mm->futex_phash, NULL); + mm->futex_phash_new = NULL; mutex_init(&mm->futex_hash_lock); } |