Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'locking-urgent-2025-02-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull locking fix from Ingo Molnar:
"Fix a dangling pointer bug in the futex code used by the uring code.
It isn't causing problems at the moment due to uring ABI limitations
leaving it essentially unused in current usages, but is a good idea to
fix nevertheless"
* tag 'locking-urgent-2025-02-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
futex: Pass in task to futex_queue()
+15
-9
+1
-1
io_uring/futex.c
+1
-1
io_uring/futex.c
+3
-2
kernel/futex/core.c
+3
-2
kernel/futex/core.c
···
532
532
futex_hb_waiters_dec(hb);
533
533
}
534
534
535
-
void __futex_queue(struct futex_q *q, struct futex_hash_bucket *hb)
535
+
void __futex_queue(struct futex_q *q, struct futex_hash_bucket *hb,
536
+
struct task_struct *task)
536
537
{
537
538
int prio;
538
539
···
549
548
550
549
plist_node_init(&q->list, prio);
551
550
plist_add(&q->list, &hb->chain);
552
-
q->task = current;
551
+
q->task = task;
553
552
}
554
553
555
554
/**
+8
-3
kernel/futex/futex.h
+8
-3
kernel/futex/futex.h
···
285
285
}
286
286
287
287
extern void __futex_unqueue(struct futex_q *q);
288
-
extern void __futex_queue(struct futex_q *q, struct futex_hash_bucket *hb);
288
+
extern void __futex_queue(struct futex_q *q, struct futex_hash_bucket *hb,
289
+
struct task_struct *task);
289
290
extern int futex_unqueue(struct futex_q *q);
290
291
291
292
/**
292
293
* futex_queue() - Enqueue the futex_q on the futex_hash_bucket
293
294
* @q: The futex_q to enqueue
294
295
* @hb: The destination hash bucket
296
+
* @task: Task queueing this futex
295
297
*
296
298
* The hb->lock must be held by the caller, and is released here. A call to
297
299
* futex_queue() is typically paired with exactly one call to futex_unqueue(). The
···
301
299
* or nothing if the unqueue is done as part of the wake process and the unqueue
302
300
* state is implicit in the state of woken task (see futex_wait_requeue_pi() for
303
301
* an example).
302
+
*
303
+
* Note that @task may be NULL, for async usage of futexes.
304
304
*/
305
-
static inline void futex_queue(struct futex_q *q, struct futex_hash_bucket *hb)
305
+
static inline void futex_queue(struct futex_q *q, struct futex_hash_bucket *hb,
306
+
struct task_struct *task)
306
307
__releases(&hb->lock)
307
308
{
308
-
__futex_queue(q, hb);
309
+
__futex_queue(q, hb, task);
309
310
spin_unlock(&hb->lock);
310
311
}
311
312
+1
-1
kernel/futex/pi.c
+1
-1
kernel/futex/pi.c
+2
-2
kernel/futex/waitwake.c
+2
-2
kernel/futex/waitwake.c
···
349
349
* access to the hash list and forcing another memory barrier.
350
350
*/
351
351
set_current_state(TASK_INTERRUPTIBLE|TASK_FREEZABLE);
352
-
futex_queue(q, hb);
352
+
futex_queue(q, hb, current);
353
353
354
354
/* Arm the timer */
355
355
if (timeout)
···
460
460
* next futex. Queue each futex at this moment so hb can
461
461
* be unlocked.
462
462
*/
463
-
futex_queue(q, hb);
463
+
futex_queue(q, hb, current);
464
464
continue;
465
465
}
466
466