From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from canpmsgout06.his.huawei.com (canpmsgout06.his.huawei.com [113.46.200.221]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7E26C1ADC83 for ; Fri, 17 Jul 2026 08:29:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=113.46.200.221 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784276985; cv=none; b=tGYPhhAG3vuiXeLjVJk7ps7XNt9fLNqzqroAhMYUv1dyNJ1U9AX4hFwpADGjs6iNCYD8FaparU7NxXPEepasEwANuGaABm52tB83CJqIHXomsiCN1WOVali1V9BJnxdYg2CeCReyZy2U8igx0mLuL93oEyl/PiGfWLq1tx7Xx78= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784276985; c=relaxed/simple; bh=8TE1W0DFZRYfasZca9aG1zzm403JjFY2R6O1jjDkUyY=; h=From:To:CC:Subject:Date:Message-ID:MIME-Version:Content-Type; b=G8zmfNOgA++rl9ztCrsVTU8uh7lbJCbU8Eegr1/TCAucetFXKlHAK+h403aI3mGaNRRwXhEZGRHwzxFXrn6Qftarn+N8pYpCPCaiq19YHZ7+b3D2KnLjvpEcJN1hThizzRE6qYVK2tvWZ6OrYbOB1LNVulBcbneweMlcHa9mODc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b=v1zLuF+8; arc=none smtp.client-ip=113.46.200.221 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b="v1zLuF+8" dkim-signature: v=1; a=rsa-sha256; d=huawei.com; s=dkim; c=relaxed/relaxed; q=dns/txt; h=From; bh=M6HRCkmFTku+molnfOdzwe1SScdtA0oQHJh1LVV9e9M=; b=v1zLuF+8fluljfTLSIKbuooijxY2WrvvtyCY0pHegpuLWhLP06KzrDSOo3Yz67wf8+fhLJ10r G6h2GR9W/4AU1bmu09PIExxtK0OvVKrhfiVxVyLJOidfYRrpN7bfdNcbu7uYYGaBxhGcxdJqQ3P uZsSLT8PUnS203Reh+mzMVM= Received: from mail.maildlp.com (unknown [172.19.162.223]) by canpmsgout06.his.huawei.com (SkyGuard) with ESMTPS id 4h1jWx0qSJzRhQm; Fri, 17 Jul 2026 16:20:13 +0800 (CST) Received: from dggpemr500006.china.huawei.com (unknown [7.185.36.185]) by mail.maildlp.com (Postfix) with ESMTPS id 6F1E140575; Fri, 17 Jul 2026 16:29:31 +0800 (CST) Received: from localhost.localdomain (10.50.85.180) by dggpemr500006.china.huawei.com (7.185.36.185) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Fri, 17 Jul 2026 16:29:30 +0800 From: Yao Kai To: CC: , , , , , , , Subject: [PATCH 0/2] futex/requeue: Fix requeue PI races Date: Fri, 17 Jul 2026 16:49:20 +0800 Message-ID: <20260717084922.4153317-1-yaokai34@huawei.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain X-ClientProxiedBy: kwepems500002.china.huawei.com (7.221.188.17) To dggpemr500006.china.huawei.com (7.185.36.185) Hi, This series fixes two independent issues in the requeue PI wait path. They are grouped because both affect the handoff between the futex requeue state machine and the target PI rtmutex. Patch 1 restores rtmutex scheduling preparation when a waiter is moved to the target PI futex before futex_do_wait() can schedule. It splits block plug flushing from worker notification so that each operation runs at a safe point. Patch 2 prevents the requeue side from accessing the waiter's stack-based futex_q after publishing Q_REQUEUE_PI_LOCKED. The waiter is instead woken through the task pointer saved before publishing completion. Both patches carry Fixes tags and are marked for stable backporting. Build testing: - arm64 defconfig with W=1 - arm64 PREEMPT_RT with KASAN_GENERIC, PROVE_LOCKING, DEBUG_RT_MUTEXES, and W=1 - kernel/futex/requeue.o and kernel/sched/core.o built successfully - all patches pass checkpatch.pl --strict Runtime testing: - Patch 1: the original rt_mutex_schedule() warning reproducer no longer triggers the warning - Patch 2: the original PREEMPT_RT KASAN reproducer no longer reports an invalid access - The futex requeue PI selftests and stress tests pass Yao Kai (2): futex/requeue: Fix rtmutex schedule preparation for requeue PI futex/requeue: Prevent rcuwait use-after-free during requeue PI include/linux/sched/rt.h | 2 ++ kernel/futex/requeue.c | 24 ++++++++++++++++++--- kernel/sched/core.c | 45 +++++++++++++++++++++++++++++++++------- 3 files changed, 60 insertions(+), 11 deletions(-) -- 2.43.0