From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from galois.linutronix.de (Galois.linutronix.de [193.142.43.55]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4973025F984 for ; Tue, 21 Jul 2026 07:19:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=193.142.43.55 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784618360; cv=none; b=fvPa0FDp93BMx1TZ6vuiTFyrGnygN1ZL0ruICKQrEkgAg6rOrRvclU/Dbvv41qY89yu+LBS+55b9fH8zDS6N050qlfrKOs/kiVTQM9n/f2+OCer3nj/s3vzVydk3qt+b3R1V9WAaocevDeUcTcBnDnJkCJR/q8a1E04uuhUjQ8k= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784618360; c=relaxed/simple; bh=9+luptsNjRhnUhIQsK1dLWD2wCM/EcP6d9OwUZLoVgc=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=cWtmxy6V8Sjy5jRJulr3DfqRKYCb825pjXKphWaSwchnpxoU2aCNXl0vLr2NwTYJrtjpgb6DWid0Z6vXg+wBqWbpBVABXjrKxeItYxjoH8DFMr7rS9+sd9KQGvwx1ZZMjrjETu2BqRO0L35FKc3XGQDOpS0GZXm7KIgnraQ2owY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linutronix.de; spf=pass smtp.mailfrom=linutronix.de; dkim=pass (2048-bit key) header.d=linutronix.de header.i=@linutronix.de header.b=FZQu7vhX; dkim=permerror (0-bit key) header.d=linutronix.de header.i=@linutronix.de header.b=hTLiFGBP; arc=none smtp.client-ip=193.142.43.55 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linutronix.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linutronix.de Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=linutronix.de header.i=@linutronix.de header.b="FZQu7vhX"; dkim=permerror (0-bit key) header.d=linutronix.de header.i=@linutronix.de header.b="hTLiFGBP" Date: Tue, 21 Jul 2026 09:19:14 +0200 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1784618356; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=Uhpz2UARvE403kZDCmJUdoutkhHFWgDuZUwfXFEh1zw=; b=FZQu7vhXwNc0jeoRjhHxWRlaRr59pvk+vvZNb/zgCJy81zoy6uGsMX27+F6j7rbej5lnwq 9unXLa4Mx+XslpWy/UT2VNml/jcAcr7DTIjnSdxzr1LIjLXyERUcb7kHWCY8Dzg7vnjrq3 WiRfKoMyumHn0WGOy5b/kLzPbWQ1C6UxWpYW9VwsjcsQFXLjP3imivTVRlQWg4hyIzdmzo BeOAPmLnaLEpmCNwWFV6eMr5GS6UD7ap5ZyqZA7PSIHm6Q/Oej0RYsv0d3rA/ivL2JaMsG TCdu2p6If3QqFHOYdTVwqXmM4MA/8LJljrMXw8Ph8wDID9KFIoL0/ZytriIb5g== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1784618356; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=Uhpz2UARvE403kZDCmJUdoutkhHFWgDuZUwfXFEh1zw=; b=hTLiFGBPPg+2Duu2VxNK/CuW6Yn5JMviU3Tu2Epjo61zw5G+lRnW98GfmUnO5aQU5Ex0gP aYzldhJxyvc88BCw== From: Sebastian Andrzej Siewior To: Yao Kai Cc: linux-kernel@vger.kernel.org, tglx@kernel.org, mingo@redhat.com, peterz@infradead.org, dvhart@infradead.org, dave@stgolabs.net, andrealmeid@igalia.com, liuyongqiang13@huawei.com Subject: Re: [PATCH 2/2] futex/requeue: Prevent rcuwait use-after-free during requeue PI Message-ID: <20260721071914.48_P-BjT@linutronix.de> References: <20260717084922.4153317-1-yaokai34@huawei.com> <20260717084922.4153317-3-yaokai34@huawei.com> <20260717093829.K07Gk1tS@linutronix.de> <235279a2-e6e4-4b6a-b76b-8a972a3e2af8@huawei.com> <20260720145539.nNAar9Bm@linutronix.de> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: On 2026-07-21 10:19:57 [+0800], Yao Kai wrote: > > > > You will miss to wake T1 if T2 skips the wake, as suggested. Or do I > > miss something? > > > > T1 T2 > futex_requeue_pi_wakeup_sync() > old = Q_REQUEUE_PI_IN_PROGRESS > new = Q_REQUEUE_PI_WAIT > cmpxchg() > requeue_pi_wake_futex() > task = READ_ONCE(q->task) > futex_requeue_pi_complete() > old = Q_REQUEUE_PI_WAIT > new = Q_REQUEUE_PI_LOCKED > cmpxchg() > if (old == Q_REQUEUE_PI_IN_PROGRESS) > rcuwait_wait_event() > rcuwait_wake_up(&q->requeue_wait); > wake_up_state(task, TASK_NORMAL) > > > Only requeue_pi_wake_futex() can publish Q_REQUEUE_PI_LOCKED. After it calls > futex_requeue_pi_complete(), it will call wake_up_state(task, TASK_NORMAL) > to wake up T1 sleeping on rcuwait_wait_event(). That one is intended for the futex_do_wait() but it seems that the outer wake_up_state() would save the day. It would deserve a comment and explanation at the least. > Yao Sebastian