From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from canpmsgout07.his.huawei.com (canpmsgout07.his.huawei.com [113.46.200.222]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D036130C15A for ; Tue, 21 Jul 2026 02:20:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=113.46.200.222 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784600413; cv=none; b=se0iV62fCIvkAl0b5yewgJGBIHwi7w3fWj4zrCk7dKxiGqifbx9dopVNd5C2oOIsZoRztl9t1er7oQTp/uYP+2Ut8AZqIr/FSGSmnvE+HV50bnLDzLh4Ka2P7+VJ3yaaDBaluR606+0GSR/S+IShFrQ+UOxZ5QaCF2VEkuLXltQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784600413; c=relaxed/simple; bh=DeP2yiexf9S1aZYDj7bLYHpf8YQ6KtZFdSRVNcv+8t0=; h=Message-ID:Date:MIME-Version:Subject:To:CC:References:From: In-Reply-To:Content-Type; b=NBafBQnqxBOCrknCxejBJRnufwx13SoXj+rxR1/RF8IA+krbmlmOm6caDFdkVwcNl9Sj1/hy2G7zaqWo0x9ca+R5lxDfVdpGPkpaJxFCDEwpGG0z7GG0M+namIbmn1h4FilRFaElivTuHNlnZJe2Z4dZXM7ndWlEdlHGL17JiG8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b=WLvMs6FA; arc=none smtp.client-ip=113.46.200.222 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b="WLvMs6FA" dkim-signature: v=1; a=rsa-sha256; d=huawei.com; s=dkim; c=relaxed/relaxed; q=dns/txt; h=From; bh=yGeM6ujpS/7ziHPWuxt6d7nXjHJB5VCMEqbhTuisZQI=; b=WLvMs6FARyVPVeIwS9v3r2MygFWZ6BRtY/6OCxnlVTfkfuuvaH8q44MaXzd9ncvY9NorlHvkP aTHHAHgnfMV+TGTxgTtmokNjdlkSZRQvvsKkTyLeY1VzxJOrFO7HZ88q55XRQDbUgIoGm3+tMQ0 uuMqpXdbdr8iLy6VbWKdY1o= Received: from mail.maildlp.com (unknown [172.19.163.163]) by canpmsgout07.his.huawei.com (SkyGuard) with ESMTPS id 4h417d1TTVzLlXf; Tue, 21 Jul 2026 10:10:37 +0800 (CST) Received: from dggpemr500006.china.huawei.com (unknown [7.185.36.185]) by mail.maildlp.com (Postfix) with ESMTPS id 170BB4048B; Tue, 21 Jul 2026 10:19:59 +0800 (CST) Received: from [100.103.109.15] (100.103.109.15) by dggpemr500006.china.huawei.com (7.185.36.185) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Tue, 21 Jul 2026 10:19:58 +0800 Message-ID: Date: Tue, 21 Jul 2026 10:19:57 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH 2/2] futex/requeue: Prevent rcuwait use-after-free during requeue PI To: Sebastian Andrzej Siewior CC: , , , , , , , References: <20260717084922.4153317-1-yaokai34@huawei.com> <20260717084922.4153317-3-yaokai34@huawei.com> <20260717093829.K07Gk1tS@linutronix.de> <235279a2-e6e4-4b6a-b76b-8a972a3e2af8@huawei.com> <20260720145539.nNAar9Bm@linutronix.de> Content-Language: en-US From: Yao Kai In-Reply-To: <20260720145539.nNAar9Bm@linutronix.de> Content-Type: text/plain; charset="UTF-8"; format=flowed Content-Transfer-Encoding: 7bit X-ClientProxiedBy: kwepems100001.china.huawei.com (7.221.188.238) To dggpemr500006.china.huawei.com (7.185.36.185) On 7/20/2026 10:55 PM, Sebastian Andrzej Siewior wrote: > On 2026-07-20 10:50:55 [+0800], Yao Kai wrote: >> >> >> On 7/17/2026 5:38 PM, Sebastian Andrzej Siewior wrote: >>> On 2026-07-17 16:49:22 [+0800], Yao Kai wrote: >>>> On PREEMPT_RT, FUTEX_CMP_REQUEUE_PI can trigger a KASAN report: >>>> >>>> BUG: KASAN: slab-out-of-bounds in _raw_spin_lock_irqsave+0x76/0xe0 >>>> Call Trace: >>>> _raw_spin_lock_irqsave+0x76/0xe0 >>>> try_to_wake_up+0xab/0x1540 >>>> rcuwait_wake_up+0x39/0x60 >>>> futex_requeue+0x18c3/0x1e10 >>>> >>>> The futex_q used by futex_wait_requeue_pi() is allocated on the waiter's >>>> stack. An early wakeup can race with a PI requeue as follows: >>>> >>>> waiter requeue task >>>> ------ ------------ >>>> futex_wait_requeue_pi() >>>> futex_do_wait() >>>> schedule() >>>> >>>> * timeout/signal wakes waiter * >>>> >>>> futex_requeue_pi_wakeup_sync() >>>> IN_PROGRESS -> WAIT >>>> rcuwait_wait_event() >>>> requeue_pi_wake_futex() >>>> task = READ_ONCE(q->task) >>>> futex_requeue_pi_complete() >>>> WAIT -> LOCKED >>>> return LOCKED >>>> return >>>> // q lifetime ends >>>> rcuwait_wake_up() >>>> >>>> futex_requeue_pi_complete() publishes LOCKED before calling >>>> rcuwait_wake_up(). Once the waiter observes LOCKED, it can return from >>>> futex_wait_requeue_pi() and let q go out of scope before rcuwait_wake_up() >>>> reads q->requeue_wait.task and passes the stale pointer to >>>> try_to_wake_up(). >>>> >>>> Skip rcuwait_wake_up() for Q_REQUEUE_PI_LOCKED. requeue_pi_wake_futex() >>>> already saves q->task before publishing LOCKED and wakes the saved task >>>> afterward. >>>> >>>> Fixes: 07d91ef510fb1 ("futex: Prevent requeue_pi() lock nesting issue on RT") >>>> Cc: stable@vger.kernel.org >>>> Signed-off-by: Yao Kai >>>> --- >>>> kernel/futex/requeue.c | 9 +++++++-- >>>> 1 file changed, 7 insertions(+), 2 deletions(-) >>>> >>>> diff --git a/kernel/futex/requeue.c b/kernel/futex/requeue.c >>>> index abc652b5b2dd..59e587775d9b 100644 >>>> --- a/kernel/futex/requeue.c >>>> +++ b/kernel/futex/requeue.c >>>> @@ -155,8 +155,13 @@ static inline void futex_requeue_pi_complete(struct futex_q *q, int locked) >>>> } while (!atomic_try_cmpxchg(&q->requeue_state, &old, new)); >>>> #ifdef CONFIG_PREEMPT_RT >>>> - /* If the waiter interleaved with the requeue let it know */ >>>> - if (unlikely(old == Q_REQUEUE_PI_WAIT)) >>>> + /* >>>> + * If the waiter interleaved with the requeue, let it know. For LOCKED, >>>> + * q may already be invalid, so requeue_pi_wake_futex() wakes the saved >>>> + * task instead. >>>> + */ >>>> + if (unlikely(old == Q_REQUEUE_PI_WAIT) && >>>> + new != Q_REQUEUE_PI_LOCKED) >>>> rcuwait_wake_up(&q->requeue_wait); >>> >>> Your whole assumption is based on the requeue_state in >>> futex_requeue_pi_wakeup_sync() changes from Q_REQUEUE_PI_IN_PROGRESS to >>> Q_REQUEUE_PI_WAIT and the rcuwait_wait_event() does not wait because the >>> condition becomes true before that happens. So the rcuwait_wake_up() >>> could access q.requeue_wait which is allocated on behalf of the waiter >>> which is gone. Certainly possible. But if we skip the wait in thise case >>> we probably miss the 99% cases where the waiter did wait, no? >>> >>> This looks similar to commit b549113738e8c ("futex: Prevent >>> use-after-free during requeue-PI"). >>> >>>> #endif >>>> } >>> >>> Sebastian >> >> No wakeup is missed. Q_REQUEUE_PI_LOCKED is only published by >> requeue_pi_wake_futex(), which saves q->task before publishing the state >> and calls wake_up_state(task, TASK_NORMAL) afterwards. The other >> futex_requeue_pi_complete() callers produce DONE or an error state, and >> the rcuwait wakeup is retained for those paths. > > T1 T2 > futex_requeue_pi_wakeup_sync() > old = Q_REQUEUE_PI_IN_PROGRESS > new = Q_REQUEUE_PI_WAIT > cmpxchg() > if (old == Q_REQUEUE_PI_IN_PROGRESS) > futex_requeue_pi_complete > old = Q_REQUEUE_PI_WAIT > new = Q_REQUEUE_PI_LOCKED > cmpxchg() > rcuwait_wait_event() > > rcuwait_wake_up(&q->requeue_wait); > > So this your case then T2 updates the state before T1 enters sleep > because the condition was true before that. So you patch makes sense. > However given the more common case: > > T1 T2 > futex_requeue_pi_wakeup_sync() > old = Q_REQUEUE_PI_IN_PROGRESS > new = Q_REQUEUE_PI_WAIT > cmpxchg() > futex_requeue_pi_complete > old = Q_REQUEUE_PI_WAIT > new = Q_REQUEUE_PI_LOCKED > cmpxchg() > if (old == Q_REQUEUE_PI_IN_PROGRESS) > rcuwait_wait_event() > rcuwait_wake_up(&q->requeue_wait); > > > You will miss to wake T1 if T2 skips the wake, as suggested. Or do I > miss something? > T1 T2 futex_requeue_pi_wakeup_sync() old = Q_REQUEUE_PI_IN_PROGRESS new = Q_REQUEUE_PI_WAIT cmpxchg() requeue_pi_wake_futex() task = READ_ONCE(q->task) futex_requeue_pi_complete() old = Q_REQUEUE_PI_WAIT new = Q_REQUEUE_PI_LOCKED cmpxchg() if (old == Q_REQUEUE_PI_IN_PROGRESS) rcuwait_wait_event() rcuwait_wake_up(&q->requeue_wait); wake_up_state(task, TASK_NORMAL) Only requeue_pi_wake_futex() can publish Q_REQUEUE_PI_LOCKED. After it calls futex_requeue_pi_complete(), it will call wake_up_state(task, TASK_NORMAL) to wake up T1 sleeping on rcuwait_wait_event(). >> Thanks, >> Yao > > Sebastian Yao