From: Sebastian Andrzej Siewior Date: Mon, 23 Jun 2025 08:34:08 +0000 (+0200) Subject: futex: Initialize futex_phash_new during fork(). X-Git-Tag: v6.16-rc4~6^2 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=a24cc6ce1933eade12aa2b9859de0fcd2dac2c06;p=thirdparty%2Flinux.git futex: Initialize futex_phash_new during fork(). During a hash resize operation the new private hash is stored in mm_struct::futex_phash_new if the current hash can not be immediately replaced. The new hash must not be copied during fork() into the new task. Doing so will lead to a double-free of the memory by the two tasks. Initialize the mm_struct::futex_phash_new during fork(). Closes: https://lore.kernel.org/all/aFBQ8CBKmRzEqIfS@mozart.vkv.me/ Fixes: bd54df5ea7cad ("futex: Allow to resize the private local hash") Reported-by: Calvin Owens Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Peter Zijlstra (Intel) Tested-by: Calvin Owens Link: https://lkml.kernel.org/r/20250623083408.jTiJiC6_@linutronix.de --- diff --git a/include/linux/futex.h b/include/linux/futex.h index 005b040c4791b..b37193653e6b5 100644 --- a/include/linux/futex.h +++ b/include/linux/futex.h @@ -89,6 +89,7 @@ void futex_hash_free(struct mm_struct *mm); static inline void futex_mm_init(struct mm_struct *mm) { RCU_INIT_POINTER(mm->futex_phash, NULL); + mm->futex_phash_new = NULL; mutex_init(&mm->futex_hash_lock); }