Commit ee9dce44362b for kernel

commit ee9dce44362b2d8132c32964656ab6dff7dfbc6a
Author: Davidlohr Bueso <dave@stgolabs.net>
Date:   Fri May 1 12:41:23 2026 -0700

    futex: Drop CLONE_THREAD requirement for private default hash alloc

    Currently need_futex_hash_allocate_default() depends on strict pthread
    semantics, abusing CLONE_THREAD.  This breaks the non-concurrency
    assumptions when doing the mm->futex_ref pcpu allocations, leading to
    bugs[0] when sharing the mm in other ways; ie:

        BUG: KASAN: slab-use-after-free in futex_hash_put

    ... where the +1 bias can end up on a percpu counter that mm->futex_ref
    no longer points at.

    Loosen the check to cover any CLONE_VM clone, except vfork().  Excluding
    vfork keeps the existing paths untouched (no overhead), and we can't
    race in the first place: either the parent is suspended and the child
    runs alone, or mm->futex_ref is already allocated from an earlier
    CLONE_VM.

    Link: https://lore.kernel.org/all/CAL_bE8LsmCQ-FAtYDuwbJhOkt9p2wwYQwAbMh=PifC=VsiBM6A@mail.gmail.com/ [0]
    Fixes: d9b05321e21e ("futex: Move futex_hash_free() back to __mmput()")
    Reported-by: Yiming Qian <yimingqian591@gmail.com>
    Signed-off-by: Davidlohr Bueso <dave@stgolabs.net>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

diff --git a/kernel/fork.c b/kernel/fork.c
index f1ad69c6dc2d..5f3fdfdb14c7 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1951,9 +1951,11 @@ static void rv_task_fork(struct task_struct *p)

 static bool need_futex_hash_allocate_default(u64 clone_flags)
 {
-	if ((clone_flags & (CLONE_THREAD | CLONE_VM)) != (CLONE_THREAD | CLONE_VM))
-		return false;
-	return true;
+	/*
+	 * Allocate a default futex hash for any sibling that will
+	 * share the parent's mm, except vfork.
+	 */
+	return (clone_flags & (CLONE_VM | CLONE_VFORK)) == CLONE_VM;
 }

 /*
@@ -2380,10 +2382,6 @@ __latent_entropy struct task_struct *copy_process(
 	if (retval)
 		goto bad_fork_cancel_cgroup;

-	/*
-	 * Allocate a default futex hash for the user process once the first
-	 * thread spawns.
-	 */
 	if (need_futex_hash_allocate_default(clone_flags)) {
 		retval = futex_hash_allocate_default();
 		if (retval)