During a hash resize operation the new private hash is stored in mm_struct::futex_phash_new if the current hash can not be immediately replaced. The new hash must not be copied during fork() into the new task. Doing so will lead to a double-free of the memory by the two tasks. Initialize the mm_struct::futex_phash_new during fork().
Unified · Split
| @@ -89,6 +89,7 @@ void futex_hash_free(struct mm_struct *mm); · 88 unmodified lines | |||
| 89 | static inline void futex_mm_init(struct mm_struct *mm) | 89 | static inline void futex_mm_init(struct mm_struct *mm) |
| 90 | { | 90 | { |
| 91 | RCU_INIT_POINTER(mm->futex_phash, NULL); | 91 | RCU_INIT_POINTER(mm->futex_phash, NULL); |
| 92 | mm->futex_phash_new = NULL; | ||
| 92 | mutex_init(&mm->futex_hash_lock); | 93 | mutex_init(&mm->futex_hash_lock); |
| 93 | } | 94 | } |
| 94 | 95 | ||