Jann Horn 3267512ad1 futex: Fix mm reuse handling for FUT_OFF_MMSHARED ... A FUT_OFF_MMSHARED futex is a shared futex that refers to an MM. It is possible for a process to wait on a shared futex with a different MM because a FUT_OFF_INODE waiter can be requeued onto a FUT_OFF_MMSHARED futex by another process. This can cause FUT_OFF_MMSHARED waiters on a freed MM to consume wakeups intended for a newly allocated MM at the same address. Fix it by keying FUT_OFF_MMSHARED using a unique 64-bit per-MM ID. Leave private futexes as before to avoid influencing the performance of the hotpath. (Multi-threaded processes typically implicitly use FUT_OFF_MMSHARED by setting clear_child_tid such that it points into anonymous memory, which causes mm_release() in a multi-threaded mm to perform FUTEX_WAKE.) Fixes: 222993395e ("futex: Remove pointless mmgrap() + mmdrop()") Closes: https://lore.kernel.org/r/CAG48ez0dLBpc3QtbAhMMVNHwHL94iHh2G+h-=BVFR4dDuzZr1g@mail.gmail.com/ Signed-off-by: Jann Horn <jannh@google.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://patch.msgid.link/20260929-futex-mmshared-fix-v1-1-262b1ffeb3d0@google.com Cc: stable@vger.kernel.org		2026-10-14 15:11:48 +02:00
..
core.c	futex: Fix mm reuse handling for FUT_OFF_MMSHARED	2026-10-14 15:11:48 +02:00
futex.h	futex: Optimize futex hash bucket access patterns	2026-06-11 13:41:24 +02:00
Makefile	futex: Convert to compiler context analysis	2026-03-16 13:16:48 +01:00
pi.c	futex: Provide rt_mutex_.*_schedule() equivalents for futex scheduling	2026-09-04 08:14:15 +02:00
requeue.c	futex: Prevent rcuwait use-after-free during requeue PI	2026-09-04 08:14:15 +02:00
syscalls.c	futex: Add support for unlocking robust futexes	2026-06-03 11:38:51 +02:00
waitwake.c	futex: Optimize futex hash bucket access patterns	2026-06-11 13:41:24 +02:00