From: Thomas Gleixner <tglx@linutronix.de>
To: Peter Zijlstra <peterz@infradead.org>,
Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Cc: linux-kernel@vger.kernel.org,
"André Almeida" <andrealmeid@igalia.com>,
"Darren Hart" <dvhart@infradead.org>,
"Davidlohr Bueso" <dave@stgolabs.net>,
"Ingo Molnar" <mingo@redhat.com>,
"Borislav Petkov" <bp@alien8.de>, "Yao Kai" <yaokai34@huawei.com>
Subject: Re: [PATCH v3 1/2] futex: Add missing rt_mutex_.*_schedule() around rt_mutex_wait_proxy_lock()
Date: Wed, 26 Aug 2026 20:06:11 +0200 [thread overview]
Message-ID: <874igghi3w.ffs@fw13> (raw)
In-Reply-To: <20260824132334.GI687043@noisy.programming.kicks-ass.net>
On Mon, Aug 24 2026 at 15:23, Peter Zijlstra wrote:
> On Mon, Aug 24, 2026 at 02:55:42PM +0200, Sebastian Andrzej Siewior wrote:
>> #include "futex.h"
>> @@ -865,7 +866,10 @@ int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
>> case Q_REQUEUE_PI_DONE:
>> /* Requeue completed. Current is 'pi_blocked_on' the rtmutex */
>> pi_mutex = &q.pi_state->pi_mutex;
>> +
>
> /*
> * Since current is doing the requeue, it cannot also be
> * a waiter on the same futex.
> */
Current is not the task doing the requeue. Current is the requeued waiter which is
blocked on the rtmutex.
Though the change log is confusing at best. The whole requeue explanation
is not really helpful IMO.
The point is that _all_ invocations of rt_mutex_schedule() must be
preceeded by a call to rt_mutex_pre_schedule() and followed by a call to
rt_mutex_post_schedule().
So this code simply failed to do that, which triggers the
lockdep_assert() in rt_mutex_schedule().
And it's obvious from the surrounding comments how this task got there, no?
>> + rt_mutex_pre_schedule();
>> ret = rt_mutex_wait_proxy_lock(pi_mutex, to, &rt_waiter);
>> + rt_mutex_post_schedule();
>>
>> /*
>> * See futex_unlock_pi()'s cleanup: comment.
>> --
>> 2.55.0
>>
next prev parent reply other threads:[~2026-08-26 18:06 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-24 12:55 [PATCH v3 0/2] futex: Address two futex-requeue-pi issues Sebastian Andrzej Siewior
2026-08-24 12:55 ` [PATCH v3 1/2] futex: Add missing rt_mutex_.*_schedule() around rt_mutex_wait_proxy_lock() Sebastian Andrzej Siewior
2026-08-24 13:23 ` Peter Zijlstra
2026-08-24 14:09 ` Sebastian Andrzej Siewior
2026-08-26 18:06 ` Thomas Gleixner [this message]
2026-08-27 8:37 ` Sebastian Andrzej Siewior
2026-08-27 12:31 ` Thomas Gleixner
2026-08-24 12:55 ` [PATCH v3 2/2] futex: Prevent rcuwait use-after-free during requeue PI Sebastian Andrzej Siewior
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=874igghi3w.ffs@fw13 \
--to=tglx@linutronix.de \
--cc=andrealmeid@igalia.com \
--cc=bigeasy@linutronix.de \
--cc=bp@alien8.de \
--cc=dave@stgolabs.net \
--cc=dvhart@infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@redhat.com \
--cc=peterz@infradead.org \
--cc=yaokai34@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®