Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'locking-urgent-2025-09-07' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull locking fix from Ingo Molnar:
"Fix an 'allocation from atomic context' regression in the futex
vmalloc variant"
* tag 'locking-urgent-2025-09-07' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
futex: Move futex_hash_free() back to __mmput()
+13
-5
+1
-1
kernel/fork.c
+1
-1
kernel/fork.c
···
689
689
mm_pasid_drop(mm);
690
690
mm_destroy_cid(mm);
691
691
percpu_counter_destroy_many(mm->rss_stat, NR_MM_COUNTERS);
692
-
futex_hash_free(mm);
693
692
694
693
free_mm(mm);
695
694
}
···
1137
1138
if (mm->binfmt)
1138
1139
module_put(mm->binfmt->module);
1139
1140
lru_gen_del_mm(mm);
1141
+
futex_hash_free(mm);
1140
1142
mmdrop(mm);
1141
1143
}
1142
1144
+12
-4
kernel/futex/core.c
+12
-4
kernel/futex/core.c
···
1722
1722
RCU_INIT_POINTER(mm->futex_phash, NULL);
1723
1723
mm->futex_phash_new = NULL;
1724
1724
/* futex-ref */
1725
+
mm->futex_ref = NULL;
1725
1726
atomic_long_set(&mm->futex_atomic, 0);
1726
1727
mm->futex_batches = get_state_synchronize_rcu();
1727
-
mm->futex_ref = alloc_percpu(unsigned int);
1728
-
if (!mm->futex_ref)
1729
-
return -ENOMEM;
1730
-
this_cpu_inc(*mm->futex_ref); /* 0 -> 1 */
1731
1728
return 0;
1732
1729
}
1733
1730
···
1796
1799
return -EBUSY;
1797
1800
return 0;
1798
1801
}
1802
+
}
1803
+
1804
+
if (!mm->futex_ref) {
1805
+
/*
1806
+
* This will always be allocated by the first thread and
1807
+
* therefore requires no locking.
1808
+
*/
1809
+
mm->futex_ref = alloc_percpu(unsigned int);
1810
+
if (!mm->futex_ref)
1811
+
return -ENOMEM;
1812
+
this_cpu_inc(*mm->futex_ref); /* 0 -> 1 */
1799
1813
}
1800
1814
1801
1815
fph = kvzalloc(struct_size(fph, queues, hash_slots),