futex: Fix mm reuse handling for FUT_OFF_MMSHARED
Impact
In the Linux kernel, the following vulnerability has been resolved:
Source excerpt · LinuxAffected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
Linux · Linux
Other versions: unaffected
| Version / range | Source status |
|---|---|
| 222993395ed38f3751287f4bd82ef46b3eb3a66d to before c17cc2027773e8e4913c5ab0fe3a489b1ed5bf81 | affected |
| 222993395ed38f3751287f4bd82ef46b3eb3a66d to before 2855ddc6844f527e375e78afb55ec2a5182f23b3 | affected |
| 222993395ed38f3751287f4bd82ef46b3eb3a66d to before 3267512ad1c2cc0c7768c5b014dc2cceb398a801 | affected |
Linux · Linux
Other versions: affected
| Version / range | Source status |
|---|---|
| 5.7 | affected |
| 0 to before 5.7 | unaffected |
| 6.18.59 through 6.18.* (inclusive) | unaffected |
| 7.2.13 through 7.2.* (inclusive) | unaffected |
| 7.3 through * (inclusive) | unaffected |
Original source description
In the Linux kernel, the following vulnerability has been resolved:
futex: Fix mm reuse handling for FUT_OFF_MMSHARED
A FUT_OFF_MMSHARED futex is a shared futex that refers to an MM. It is possible for a process to wait on a shared futex with a different MM because a FUT_OFF_INODE waiter can be requeued onto a FUT_OFF_MMSHARED futex by another process. This can cause FUT_OFF_MMSHARED waiters on a freed MM to consume wakeups intended for a newly allocated MM at the same address.
Fix it by keying FUT_OFF_MMSHARED using a unique 64-bit per-MM ID. Leave private futexes as before to avoid influencing the performance of the hotpath.
(Multi-threaded processes typically implicitly use FUT_OFF_MMSHARED by setting clear_child_tid such that it points into anonymous memory, which causes mm_release() in a multi-threaded mm to perform FUTEX_WAKE.)