[PATCH v2] futex: Canonicalize arm64 tagged user addresses

[PATCH v2] futex: Canonicalize arm64 tagged user addresses

[Shubhang Kaushik (Ampere)]

On arm64, a thread that enables the tagged address ABI can pass valid
top-byte-tagged user pointers to futex syscalls. Such a pointer must
have the same syscall behaviour as its untagged form.

get_futex_key() validates the user address with access_ok(), but uses
the raw address when constructing private and shared-anonymous futex
keys. A waiter using a tagged address and a waker using the untagged
form can therefore access the same futex word while hashing to distinct
keys, causing FUTEX_WAKE to miss the waiter.

Keep access_ok() on the original pointer so that arm64 retains its
per-thread tagged-address ABI enforcement. Canonicalize the address
afterwards, before it is used for futex key construction and shared
mapping lookup.

Add an arm64 64-bit selftest for a tagged private waiter woken through
the corresponding untagged address.

Fixes: 63f0c6037965 ("arm64: Introduce prctl() options to control the tagged user addresses ABI")
Cc: stable@vger.kernel.org
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Shubhang Kaushik (Ampere) <sh@gentwo.org>
---
Changes in v2:
- Add the generated tagged-address test binary to .gitignore.
- Compile the arm64-specific test implementation only for arm64 64-bit
  builds.
- Avoid relying on /proc/<tid>/wchan to detect that the waiter has
  queued; retry the untagged wake for a bounded interval instead.

Link to v1: https://lore.kernel.org/r/20261022-futex-arm64-tagged-uaddr-v1-1-84d8afbe7668@gentwo.org
---
 kernel/futex/core.c                                |  2 +
 .../testing/selftests/futex/functional/.gitignore  |  1 +
 tools/testing/selftests/futex/functional/Makefile  |  1 +
 .../selftests/futex/functional/futex_tagged_addr.c | 61 ++++++++++++++++++++++
 tools/testing/selftests/futex/functional/run.sh    |  3 ++
 5 files changed, 68 insertions(+)

diff --git a/kernel/futex/core.c b/kernel/futex/core.c
index a240638f69e5c65bd036434a15f3df680efb4638..dcc8ffca38595a5ea69f3672375ffb9f9c6766f9 100644
--- a/kernel/futex/core.c
+++ b/kernel/futex/core.c
@@ -539,6 +539,8 @@ int get_futex_key(u32 __user *uaddr, unsigned int flags, union futex_key *key,
 	if (unlikely(!access_ok(uaddr, size)))
 		return -EFAULT;
 
+	address = untagged_addr(address);
+
 	if (unlikely(should_fail_futex(fshared)))
 		return -EFAULT;
 
diff --git a/tools/testing/selftests/futex/functional/.gitignore b/tools/testing/selftests/futex/functional/.gitignore
index 7c39d10b38e4d86096d2d1ce5fe8d6036e8ca758..c64b93a683bd6e9f6b9d3e4f02397eb24cc5a0ad 100644
--- a/tools/testing/selftests/futex/functional/.gitignore
+++ b/tools/testing/selftests/futex/functional/.gitignore
@@ -6,6 +6,7 @@ futex_requeue
 futex_requeue_pi
 futex_requeue_pi_mismatched_ops
 futex_requeue_pi_signal_restart
+futex_tagged_addr
 futex_wait
 futex_wait_private_mapped_file
 futex_wait_timeout
diff --git a/tools/testing/selftests/futex/functional/Makefile b/tools/testing/selftests/futex/functional/Makefile
index a03bd5acba50319f08b04ff0904ef155c000fee3..8f7f6730285b725b483787362db4626c459d65c9 100644
--- a/tools/testing/selftests/futex/functional/Makefile
+++ b/tools/testing/selftests/futex/functional/Makefile
@@ -19,6 +19,7 @@ TEST_GEN_PROGS := \
 	futex_requeue_pi \
 	futex_requeue_pi_signal_restart \
 	futex_requeue_pi_mismatched_ops \
+	futex_tagged_addr \
 	futex_wait_uninitialized_heap \
 	futex_wait_private_mapped_file \
 	futex_wait \
diff --git a/tools/testing/selftests/futex/functional/futex_tagged_addr.c b/tools/testing/selftests/futex/functional/futex_tagged_addr.c
new file mode 100644
index 0000000000000000000000000000000000000000..0b0e350eff11939e42b7b1aca01136b037ed7217
--- /dev/null
+++ b/tools/testing/selftests/futex/functional/futex_tagged_addr.c
@@ -0,0 +1,61 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include <errno.h>
+#include <stdint.h>
+#include <string.h>
+#include <sys/prctl.h>
+#include <time.h>
+#include <unistd.h>
+
+#include <linux/prctl.h>
+
+#include "futextest.h"
+#include "futex_thread.h"
+#include "kselftest_harness.h"
+
+#define WAKE_RETRIES	100
+#define WAKE_WAIT_US	10000
+
+#if defined(__aarch64__) && __SIZEOF_POINTER__ == 8
+static futex_t futex;
+static futex_t *tagged_futex;
+
+static int waiterfn(void *arg)
+{
+	struct timespec timeout = { .tv_sec = 2 };
+
+	return futex_wait(tagged_futex, 0, &timeout, FUTEX_PRIVATE_FLAG);
+}
+#endif
+
+TEST(tagged_addr)
+{
+#if !defined(__aarch64__) || __SIZEOF_POINTER__ != 8
+	SKIP(return, "arm64 64-bit tagged address ABI not available");
+#else
+	struct futex_thread waiter;
+	int ret, i;
+
+	ret = prctl(PR_SET_TAGGED_ADDR_CTRL, PR_TAGGED_ADDR_ENABLE, 0, 0, 0);
+	if (ret && errno == EINVAL)
+		SKIP(return, "tagged address ABI not available");
+	ASSERT_EQ(ret, 0)
+		TH_LOG("PR_SET_TAGGED_ADDR_CTRL failed: %s", strerror(errno));
+
+	tagged_futex = (futex_t *)((uintptr_t)&futex | (0x42ULL << 56));
+	ASSERT_EQ(futex_thread_create(&waiter, waiterfn, NULL), 0)
+		TH_LOG("pthread_create failed");
+
+	for (i = 0; i < WAKE_RETRIES; i++) {
+		ret = futex_wake(&futex, 1, FUTEX_PRIVATE_FLAG);
+		if (ret)
+			break;
+		usleep(WAKE_WAIT_US);
+	}
+
+	EXPECT_EQ(ret, 1);
+	EXPECT_EQ(futex_thread_destroy(&waiter), 0);
+#endif
+}
+
+TEST_HARNESS_MAIN
diff --git a/tools/testing/selftests/futex/functional/run.sh b/tools/testing/selftests/futex/functional/run.sh
index d1a681b798bd385570710e7c5f9bb28cca64de3e..620d13ee7171e7cc6061053750c9ff4cf525ff72 100755
--- a/tools/testing/selftests/futex/functional/run.sh
+++ b/tools/testing/selftests/futex/functional/run.sh
@@ -46,6 +46,9 @@ echo
 echo
 ./futex_waitv
 
+echo
+./futex_tagged_addr
+
 echo
 ./futex_priv_hash
 

---
base-commit: 3ac032ef6ca8e47bb06d1e189dfcf88fa0a09c75
change-id: 20261030-futex-tagged-uaddr-v2-prep-63ea40b5a22f

Best regards,
-- 
Shubhang Kaushik (Ampere) <sh@gentwo.org>

Re: [PATCH v2] futex: Canonicalize arm64 tagged user addresses

[Catalin Marinas]

On Fri, Oct 30, 2026 at 03:39:59PM -0700, Shubhang Kaushik (Ampere) wrote:
> On arm64, a thread that enables the tagged address ABI can pass valid
> top-byte-tagged user pointers to futex syscalls. Such a pointer must
> have the same syscall behaviour as its untagged form.
> 
> get_futex_key() validates the user address with access_ok(), but uses
> the raw address when constructing private and shared-anonymous futex
> keys. A waiter using a tagged address and a waker using the untagged
> form can therefore access the same futex word while hashing to distinct
> keys, causing FUTEX_WAKE to miss the waiter.
> 
> Keep access_ok() on the original pointer so that arm64 retains its
> per-thread tagged-address ABI enforcement. Canonicalize the address
> afterwards, before it is used for futex key construction and shared
> mapping lookup.
> 
> Add an arm64 64-bit selftest for a tagged private waiter woken through
> the corresponding untagged address.
> 
> Fixes: 63f0c6037965 ("arm64: Introduce prctl() options to control the tagged user addresses ABI")
> Cc: stable@vger.kernel.org
> Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
> Signed-off-by: Shubhang Kaushik (Ampere) <sh@gentwo.org>
> ---
> Changes in v2:
> - Add the generated tagged-address test binary to .gitignore.
> - Compile the arm64-specific test implementation only for arm64 64-bit
>   builds.
> - Avoid relying on /proc/<tid>/wchan to detect that the waiter has
>   queued; retry the untagged wake for a bounded interval instead.
> 
> Link to v1: https://lore.kernel.org/r/20261022-futex-arm64-tagged-uaddr-v1-1-84d8afbe7668@gentwo.org
> ---
>  kernel/futex/core.c                                |  2 +
>  .../testing/selftests/futex/functional/.gitignore  |  1 +
>  tools/testing/selftests/futex/functional/Makefile  |  1 +
>  .../selftests/futex/functional/futex_tagged_addr.c | 61 ++++++++++++++++++++++
>  tools/testing/selftests/futex/functional/run.sh    |  3 ++
>  5 files changed, 68 insertions(+)

Since this is a cc stable, I'd separate the actual fix from the
kselftest with the latter not cc'ed to stable.

Thanks.

-- 
Catalin

Re: [PATCH v2] futex: Canonicalize arm64 tagged user addresses

[Davidlohr Bueso]

On Fri, 30 Oct 2026, Shubhang Kaushik (Ampere) wrote:

>On arm64, a thread that enables the tagged address ABI can pass valid
>top-byte-tagged user pointers to futex syscalls. Such a pointer must
>have the same syscall behaviour as its untagged form.
>
>get_futex_key() validates the user address with access_ok(), but uses
>the raw address when constructing private and shared-anonymous futex
>keys. A waiter using a tagged address and a waker using the untagged
>form can therefore access the same futex word while hashing to distinct
>keys, causing FUTEX_WAKE to miss the waiter.
>
>Keep access_ok() on the original pointer so that arm64 retains its
>per-thread tagged-address ABI enforcement. Canonicalize the address
>afterwards, before it is used for futex key construction and shared
>mapping lookup.
>
>Add an arm64 64-bit selftest for a tagged private waiter woken through
>the corresponding untagged address.
>
>Fixes: 63f0c6037965 ("arm64: Introduce prctl() options to control the tagged user addresses ABI")
>Cc: stable@vger.kernel.org
>Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
>Signed-off-by: Shubhang Kaushik (Ampere) <sh@gentwo.org>

lgtm

Acked-by: Davidlohr Bueso <dave@stgolabs.net>

>---
>Changes in v2:
>- Add the generated tagged-address test binary to .gitignore.
>- Compile the arm64-specific test implementation only for arm64 64-bit
>  builds.
>- Avoid relying on /proc/<tid>/wchan to detect that the waiter has
>  queued; retry the untagged wake for a bounded interval instead.
>
>Link to v1: https://lore.kernel.org/r/20261022-futex-arm64-tagged-uaddr-v1-1-84d8afbe7668@gentwo.org
>---
> kernel/futex/core.c                                |  2 +
> .../testing/selftests/futex/functional/.gitignore  |  1 +
> tools/testing/selftests/futex/functional/Makefile  |  1 +
> .../selftests/futex/functional/futex_tagged_addr.c | 61 ++++++++++++++++++++++
> tools/testing/selftests/futex/functional/run.sh    |  3 ++
> 5 files changed, 68 insertions(+)
>
>diff --git a/kernel/futex/core.c b/kernel/futex/core.c
>index a240638f69e5c65bd036434a15f3df680efb4638..dcc8ffca38595a5ea69f3672375ffb9f9c6766f9 100644
>--- a/kernel/futex/core.c
>+++ b/kernel/futex/core.c
>@@ -539,6 +539,8 @@ int get_futex_key(u32 __user *uaddr, unsigned int flags, union futex_key *key,
> 	if (unlikely(!access_ok(uaddr, size)))
> 		return -EFAULT;
>
>+	address = untagged_addr(address);
>+
> 	if (unlikely(should_fail_futex(fshared)))
> 		return -EFAULT;
>
>diff --git a/tools/testing/selftests/futex/functional/.gitignore b/tools/testing/selftests/futex/functional/.gitignore
>index 7c39d10b38e4d86096d2d1ce5fe8d6036e8ca758..c64b93a683bd6e9f6b9d3e4f02397eb24cc5a0ad 100644
>--- a/tools/testing/selftests/futex/functional/.gitignore
>+++ b/tools/testing/selftests/futex/functional/.gitignore
>@@ -6,6 +6,7 @@ futex_requeue
> futex_requeue_pi
> futex_requeue_pi_mismatched_ops
> futex_requeue_pi_signal_restart
>+futex_tagged_addr
> futex_wait
> futex_wait_private_mapped_file
> futex_wait_timeout
>diff --git a/tools/testing/selftests/futex/functional/Makefile b/tools/testing/selftests/futex/functional/Makefile
>index a03bd5acba50319f08b04ff0904ef155c000fee3..8f7f6730285b725b483787362db4626c459d65c9 100644
>--- a/tools/testing/selftests/futex/functional/Makefile
>+++ b/tools/testing/selftests/futex/functional/Makefile
>@@ -19,6 +19,7 @@ TEST_GEN_PROGS := \
> 	futex_requeue_pi \
> 	futex_requeue_pi_signal_restart \
> 	futex_requeue_pi_mismatched_ops \
>+	futex_tagged_addr \
> 	futex_wait_uninitialized_heap \
> 	futex_wait_private_mapped_file \
> 	futex_wait \
>diff --git a/tools/testing/selftests/futex/functional/futex_tagged_addr.c b/tools/testing/selftests/futex/functional/futex_tagged_addr.c
>new file mode 100644
>index 0000000000000000000000000000000000000000..0b0e350eff11939e42b7b1aca01136b037ed7217
>--- /dev/null
>+++ b/tools/testing/selftests/futex/functional/futex_tagged_addr.c
>@@ -0,0 +1,61 @@
>+// SPDX-License-Identifier: GPL-2.0-or-later
>+
>+#include <errno.h>
>+#include <stdint.h>
>+#include <string.h>
>+#include <sys/prctl.h>
>+#include <time.h>
>+#include <unistd.h>
>+
>+#include <linux/prctl.h>
>+
>+#include "futextest.h"
>+#include "futex_thread.h"
>+#include "kselftest_harness.h"
>+
>+#define WAKE_RETRIES	100
>+#define WAKE_WAIT_US	10000
>+
>+#if defined(__aarch64__) && __SIZEOF_POINTER__ == 8
>+static futex_t futex;
>+static futex_t *tagged_futex;
>+
>+static int waiterfn(void *arg)
>+{
>+	struct timespec timeout = { .tv_sec = 2 };
>+
>+	return futex_wait(tagged_futex, 0, &timeout, FUTEX_PRIVATE_FLAG);
>+}
>+#endif
>+
>+TEST(tagged_addr)
>+{
>+#if !defined(__aarch64__) || __SIZEOF_POINTER__ != 8
>+	SKIP(return, "arm64 64-bit tagged address ABI not available");
>+#else
>+	struct futex_thread waiter;
>+	int ret, i;
>+
>+	ret = prctl(PR_SET_TAGGED_ADDR_CTRL, PR_TAGGED_ADDR_ENABLE, 0, 0, 0);
>+	if (ret && errno == EINVAL)
>+		SKIP(return, "tagged address ABI not available");
>+	ASSERT_EQ(ret, 0)
>+		TH_LOG("PR_SET_TAGGED_ADDR_CTRL failed: %s", strerror(errno));
>+
>+	tagged_futex = (futex_t *)((uintptr_t)&futex | (0x42ULL << 56));
>+	ASSERT_EQ(futex_thread_create(&waiter, waiterfn, NULL), 0)
>+		TH_LOG("pthread_create failed");
>+
>+	for (i = 0; i < WAKE_RETRIES; i++) {
>+		ret = futex_wake(&futex, 1, FUTEX_PRIVATE_FLAG);
>+		if (ret)
>+			break;
>+		usleep(WAKE_WAIT_US);
>+	}
>+
>+	EXPECT_EQ(ret, 1);
>+	EXPECT_EQ(futex_thread_destroy(&waiter), 0);
>+#endif
>+}
>+
>+TEST_HARNESS_MAIN
>diff --git a/tools/testing/selftests/futex/functional/run.sh b/tools/testing/selftests/futex/functional/run.sh
>index d1a681b798bd385570710e7c5f9bb28cca64de3e..620d13ee7171e7cc6061053750c9ff4cf525ff72 100755
>--- a/tools/testing/selftests/futex/functional/run.sh
>+++ b/tools/testing/selftests/futex/functional/run.sh
>@@ -46,6 +46,9 @@ echo
> echo
> ./futex_waitv
>
>+echo
>+./futex_tagged_addr
>+
> echo
> ./futex_priv_hash
>
>
>---
>base-commit: 3ac032ef6ca8e47bb06d1e189dfcf88fa0a09c75
>change-id: 20261030-futex-tagged-uaddr-v2-prep-63ea40b5a22f
>
>Best regards,
>-- 
>Shubhang Kaushik (Ampere) <sh@gentwo.org>
>