Merge tag 'locking_urgent_for_v6.17_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

torvalds · torvalds · commit 8e8f6b635fae · 2025-08-10T08:11:39.000+03:00
Pull locking fix from Borislav Petkov:

 - Prevent a futex hash leak due to different mm lifetimes

* tag 'locking_urgent_for_v6.17_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  futex: Move futex cleanup to __mmdrop()
diff --git a/kernel/fork.c b/kernel/fork.c
@@ -689,6 +689,7 @@ void __mmdrop(struct mm_struct *mm)
 	mm_pasid_drop(mm);
 	mm_destroy_cid(mm);
 	percpu_counter_destroy_many(mm->rss_stat, NR_MM_COUNTERS);
+	futex_hash_free(mm);
 
 	free_mm(mm);
 }
@@ -1137,7 +1138,6 @@ static inline void __mmput(struct mm_struct *mm)
 	if (mm->binfmt)
 		module_put(mm->binfmt->module);
 	lru_gen_del_mm(mm);
-	futex_hash_free(mm);
 	mmdrop(mm);
 }
 

Original file line number	Diff line number	Diff line change
`@@ -689,6 +689,7 @@ void __mmdrop(struct mm_struct *mm)`
`689`	`689`	`mm_pasid_drop(mm);`
`690`	`690`	`mm_destroy_cid(mm);`
`691`	`691`	`percpu_counter_destroy_many(mm->rss_stat, NR_MM_COUNTERS);`
	`692`	`+ futex_hash_free(mm);`
`692`	`693`
`693`	`694`	`free_mm(mm);`
`694`	`695`	`}`
`@@ -1137,7 +1138,6 @@ static inline void __mmput(struct mm_struct *mm)`
`1137`	`1138`	`if (mm->binfmt)`
`1138`	`1139`	`module_put(mm->binfmt->module);`
`1139`	`1140`	`lru_gen_del_mm(mm);`
`1140`		`- futex_hash_free(mm);`
`1141`	`1141`	`mmdrop(mm);`
`1142`	`1142`	`}`
`1143`	`1143`