From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from silver.cherry.relay.mailchannels.net (silver.cherry.relay.mailchannels.net [23.83.223.166]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C6FCA309EF4 for ; Mon, 13 Jul 2026 16:15:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=23.83.223.166 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783959339; cv=none; b=PB9MY28fMo4nMkRwxJh/DPmBhGsXLdnid/qnytLr5u3e/ZLM3oAyX+FEL3vqm5oInct55f21yboAl762ZQpK458c7/PtDO9/82UiqUDxdf1TUwTVjlVC5hVB9vo/q7XWRwDkcuimc9y6gJ1nJ11jgIcK5w6+y5nwlz7YFFOOvTQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783959339; c=relaxed/simple; bh=QNxQn51S49ixbBAFgjWFFo8+9MfKVfIoLunUIl8gMPY=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=g+nfIE+kIK6fFlK1HZk/VYgettNPqDjCuUbgMdbtzYEfgdbDmCgBRNscl64NepayIvgr6RpnoyaNltG0KGMP4l3CADc1f0e1fxZFt7I8jCH1Bq0GPvQzC1lb0Szwdn9ahdP3IvJ4dqpgeu4RM3d8cLwr+7YxM0asO/HgHZjAoVM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=stgolabs.net; spf=fail smtp.mailfrom=stgolabs.net; dkim=pass (2048-bit key) header.d=stgolabs.net header.i=@stgolabs.net header.b=VFFikpAi; arc=none smtp.client-ip=23.83.223.166 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=stgolabs.net Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=stgolabs.net Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=stgolabs.net header.i=@stgolabs.net header.b="VFFikpAi" X-Sender-Id: dreamhost|x-authsender|dave@stgolabs.net Received: from relay.mailchannels.net (localhost [127.0.0.1]) by relay.mailchannels.net (Postfix) with ESMTP id BD313721C4F; Mon, 13 Jul 2026 16:15:33 +0000 (UTC) Received: from pdx1-sub0-mail-a235.dreamhost.com (100-104-248-19.trex-nlb.outbound.svc.cluster.local [100.104.248.19]) (Authenticated sender: dreamhost) by relay.mailchannels.net (Postfix) with ESMTPA id 47CE972205B; Mon, 13 Jul 2026 16:15:33 +0000 (UTC) X-Sender-Id: dreamhost|x-authsender|dave@stgolabs.net X-MC-Relay: Neutral X-MailChannels-SenderId: dreamhost|x-authsender|dave@stgolabs.net X-MailChannels-Auth-Id: dreamhost X-Occur-Continue: 756d446a7bc50553_1783959333583_3417897836 X-MC-Loop-Signature: 1783959333583:3589547963 X-MC-Ingress-Time: 1783959333583 Received: from pdx1-sub0-mail-a235.dreamhost.com (pop.dreamhost.com [64.90.62.162]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384) by 100.104.248.19 (trex/8.0.2); Mon, 13 Jul 2026 16:15:33 +0000 Received: from offworld (unknown [76.167.199.67]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-256) server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: dave@stgolabs.net) by pdx1-sub0-mail-a235.dreamhost.com (Postfix) with ESMTPSA id 4gzSGD3z4Qzymc; Mon, 13 Jul 2026 09:15:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=stgolabs.net; s=dreamhost; t=1783959333; bh=cZeBYkFPGiKp7Lt+LG4J63ku/ahjD8wRrqJGd55IGyI=; h=Date:From:To:Cc:Subject:Content-Type; b=VFFikpAi89Zz6/ctqOaoPCSpZEu93yfYWBamBVKCnQ8g5Oubb+2hWDYjG0br07CeR a/lyQHfmhgobvWVEBVU9Px7v8oXgUkZseUGQNkkVuDXZ+JiLbGIUmJ8MR0SgeGah+p UAkbSTJb1KglH2QHWC2fFmBBMmE8hxlxsuDVeJgkeB7FI9+WmcqmpCwZ073wfBd++t QA0gqHKhj8aA13bLmjbBI+8Kpugv+HI5tMcJ1+jlucjMTYPn9M11iALMzj/Dn29x3D 4fkpIxnkXRboMgBFo/6aIFq5KriyDUY8N2yEQdXGB+f6K9n67201I6Yp+0cibNKz5K xw9VSeBSHjwcw== Date: Mon, 13 Jul 2026 09:15:29 -0700 From: Davidlohr Bueso To: pjw@kernel.org, palmer@dabbelt.com Cc: aou@eecs.berkeley.edu, alex@ghiti.fr, tglx@kernel.org, mingo@redhat.com, peterz@infradead.org, dvhart@infradead.org, andrealmeid@igalia.com, linux-riscv@lists.infradead.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH v2] riscv/futex: Bound number of LL/SC retries in cmpxchg Message-ID: <20260713161529.arwwntkwpg75opzk@offworld> References: <20260505125204.999119-1-dave@stgolabs.net> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Disposition: inline In-Reply-To: <20260505125204.999119-1-dave@stgolabs.net> User-Agent: NeoMutt/20220429 ping? On Tue, 05 May 2026, Davidlohr Bueso wrote: >futex_atomic_cmpxchg_inatomic() does an unbounded LR/SC retry loop while >(minimally) holding the hb lock + pf disabled. This can lead to pathological >cases from unpriviledged userspace pi operations. > >Bound the retry loop to (arbitrarily) 128 iterations and bail: drop locks, >rechedule and retry the operation, similar to the arm64 variant, as of >03110a5cb216 ("arm64: futex: Bound number of LDXR/STXR loops in FUTEX_WAKE_OP"). > >Signed-off-by: Davidlohr Bueso >--- >v2: patch now applies (and removed a whitespace change). >Compile tested only. > > arch/riscv/include/asm/futex.h | 14 +++++++++++--- > 1 file changed, 11 insertions(+), 3 deletions(-) > >diff --git a/arch/riscv/include/asm/futex.h b/arch/riscv/include/asm/futex.h >index 90c86b115e00..be69d4211248 100644 >--- a/arch/riscv/include/asm/futex.h >+++ b/arch/riscv/include/asm/futex.h >@@ -13,6 +13,8 @@ > #include > #include > >+#define FUTEX_MAX_LOOPS 128 >+ > /* We don't even really need the extable code, but for now keep it simple */ > #ifndef CONFIG_MMU > #define __enable_user_access() do { } while (0) >@@ -79,6 +81,7 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr, > int ret = 0; > u32 val; > uintptr_t tmp; >+ unsigned int loops = FUTEX_MAX_LOOPS; > > if (!access_ok(uaddr, sizeof(u32))) > return -EFAULT; >@@ -88,12 +91,17 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr, > "1: lr.w %[v],%[u] \n" > " bne %[v],%z[ov],3f \n" > "2: sc.w.aqrl %[t],%z[nv],%[u] \n" >- " bnez %[t],1b \n" >+ " beqz %[t],3f \n" >+ " addi %[lp],%[lp],-1 \n" >+ " bnez %[lp],1b \n" >+ " li %[r],%[eagain] \n" > "3: \n" > _ASM_EXTABLE_UACCESS_ERR(1b, 3b, %[r]) \ > _ASM_EXTABLE_UACCESS_ERR(2b, 3b, %[r]) \ >- : [r] "+r" (ret), [v] "=&r" (val), [u] "+m" (*uaddr), [t] "=&r" (tmp) >- : [ov] "Jr" ((long)(int)oldval), [nv] "Jr" (newval) >+ : [r] "+r" (ret), [v] "=&r" (val), [u] "+m" (*uaddr), >+ [t] "=&r" (tmp), [lp] "+r" (loops) >+ : [ov] "Jr" ((long)(int)oldval), [nv] "Jr" (newval), >+ [eagain] "i" (-EAGAIN) > : "memory"); > __disable_user_access(); > >-- >2.39.5 > > >_______________________________________________ >linux-riscv mailing list >linux-riscv@lists.infradead.org >http://lists.infradead.org/mailman/listinfo/linux-riscv