Re: [PATCH] futex: Prevent use-after-free during requeue-PI

[Sebastian Andrzej Siewior <bigeasy@linutronix.de>]

On 2025-09-10 12:42:45 [+0200], To Thomas Gleixner wrote:
> --- a/kernel/futex/requeue.c
> +++ b/kernel/futex/requeue.c
> @@ -243,10 +244,11 @@ void requeue_pi_wake_futex(struct futex_q *q, union futex_key *key,
>  	futex_hash_get(hb);
>  	q->drop_hb_ref = true;
>  	q->lock_ptr = &hb->lock;
> +	task = READ_ONCE(q->task);
>  
>  	/* Signal locked state to the waiter */
>  	futex_requeue_pi_complete(q, 1);

once understood, adding an mdelay(500) here greatly improves the chances
to trigger.
futex_requeue_pi_complete() uses atomic_try_cmpxchg() which has full
ordering. This means that the q->drop_hb_ref assignment earlier is
visible to the other thread after that cmpxchg, correct? 

> -	wake_up_state(q->task, TASK_NORMAL);
> +	wake_up_state(task, TASK_NORMAL);
>  }

Sebastian