Re: kernel/futex/core.c:505:38: sparse: sparse: cast removes address space '__user' of expression

[Sebastian Andrzej Siewior <bigeasy@linutronix.de>]

On 2026-01-13 13:10:40 [+0100], Peter Zijlstra wrote:
> Its here and a few lines down with the same thing I think. The cast is
> to get byte pointer math, instead of u32 sized pointer math. Both the
> original uaddr and naddr have the __user thing on, but that intermediate
> cast trips it up.
> 
> Does this work?

Yes. It removes the __user thing warning which leaves us with
| kernel/futex/requeue.c:692:9: warning: context imbalance in 'futex_requeue' - different lock contexts for basic block
| kernel/futex/requeue.c:841:25: warning: context imbalance in 'futex_wait_requeue_pi' - unexpected unlock
| kernel/futex/pi.c:663:9: warning: context imbalance in 'wake_futex_pi' - unexpected unlock
| kernel/futex/pi.c:791:9: warning: context imbalance in '__fixup_pi_state_owner' - unexpected unlock
| kernel/futex/pi.c:1093:17: warning: context imbalance in 'futex_lock_pi' - unexpected unlock
| kernel/futex/pi.c:1132:5: warning: context imbalance in 'futex_unlock_pi' - different lock contexts for basic block
| kernel/futex/waitwake.c:275:41: warning: context imbalance in 'futex_wake_op' - different lock contexts for basic block
| kernel/futex/waitwake.c:460:44: warning: context imbalance in 'futex_wait_multiple_setup' - unexpected unlock
| kernel/futex/waitwake.c:660:28: warning: context imbalance in 'futex_wait_setup' - unexpected unlock
| kernel/futex/core.c:979:9: warning: context imbalance in 'futex_q_lockptr_lock' - wrong count at exit

With the following I get it down to:

| kernel/futex/waitwake.c:275:41: warning: context imbalance in 'futex_wake_op' - different lock contexts for basic block
| kernel/futex/requeue.c:692:9: warning: context imbalance in 'futex_requeue' - different lock contexts for basic block
double_lock_hb() + double_unlock_hb()

| kernel/futex/pi.c:792:9: warning: context imbalance in '__fixup_pi_state_owner' - unexpected unlock
raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock) + lock in a label.

which I give up on. I remember you said once that llvm will get support
for it so we can bury sparse but I don't remember if it was __user or
the lock lock annotation. Any all of these are "old".

diff --git a/kernel/futex/core.c b/kernel/futex/core.c
index 3961d256c79c4..6911d60fc5815 100644
--- a/kernel/futex/core.c
+++ b/kernel/futex/core.c
@@ -965,6 +965,7 @@ int futex_unqueue(struct futex_q *q)
 }
 
 void futex_q_lockptr_lock(struct futex_q *q)
+	__acquires(q->lock_ptr)
 {
 	spinlock_t *lock_ptr;
 
diff --git a/kernel/futex/futex.h b/kernel/futex/futex.h
index 99595742c9941..1eba1a7a80efd 100644
--- a/kernel/futex/futex.h
+++ b/kernel/futex/futex.h
@@ -217,7 +217,7 @@ enum futex_access {
 
 extern int get_futex_key(void __user *uaddr, unsigned int flags, union futex_key *key,
 			 enum futex_access rw);
-extern void futex_q_lockptr_lock(struct futex_q *q);
+extern void futex_q_lockptr_lock(struct futex_q *q) __acquires(q->lock_ptr);
 extern struct hrtimer_sleeper *
 futex_setup_timer(ktime_t *time, struct hrtimer_sleeper *timeout,
 		  int flags, u64 range_ns);
@@ -358,8 +358,8 @@ static inline int futex_hb_waiters_pending(struct futex_hash_bucket *hb)
 #endif
 }
 
-extern void futex_q_lock(struct futex_q *q, struct futex_hash_bucket *hb);
-extern void futex_q_unlock(struct futex_hash_bucket *hb);
+extern void futex_q_lock(struct futex_q *q, struct futex_hash_bucket *hb) __acquires(&hb->lock);
+extern void futex_q_unlock(struct futex_hash_bucket *hb) __releases(&hb->lock);
 
 
 extern int futex_lock_pi_atomic(u32 __user *uaddr, struct futex_hash_bucket *hb,
diff --git a/kernel/futex/pi.c b/kernel/futex/pi.c
index dacb2330f1fbc..6a93a5eb5a0ab 100644
--- a/kernel/futex/pi.c
+++ b/kernel/futex/pi.c
@@ -614,6 +614,7 @@ int futex_lock_pi_atomic(u32 __user *uaddr, struct futex_hash_bucket *hb,
 static int wake_futex_pi(u32 __user *uaddr, u32 uval,
 			 struct futex_pi_state *pi_state,
 			 struct rt_mutex_waiter *top_waiter)
+	__releases(q->lock_ptr)
 {
 	struct task_struct *new_owner;
 	bool postunlock = false;