All of lore.kernel.org
 help / color / mirror / Atom feed
From: Thomas Gleixner <tglx@linutronix.de>
To: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Cc: "Peter Zijlstra" <peterz@infradead.org>,
	linux-kernel@vger.kernel.org,
	"André Almeida" <andrealmeid@igalia.com>,
	"Darren Hart" <dvhart@infradead.org>,
	"Davidlohr Bueso" <dave@stgolabs.net>,
	"Ingo Molnar" <mingo@redhat.com>,
	"Borislav Petkov" <bp@alien8.de>, "Yao Kai" <yaokai34@huawei.com>
Subject: Re: [PATCH v3 1/2] futex: Add missing rt_mutex_.*_schedule() around rt_mutex_wait_proxy_lock()
Date: Thu, 27 Aug 2026 14:31:56 +0200	[thread overview]
Message-ID: <87mru7g2wz.ffs@fw13> (raw)
In-Reply-To: <20260827083738.-6QSwUwb@linutronix.de>

On Thu, Aug 27 2026 at 10:37, Sebastian Andrzej Siewior wrote:
> On 2026-08-26 20:06:11 [+0200], Thomas Gleixner wrote:
>> On Mon, Aug 24 2026 at 15:23, Peter Zijlstra wrote:
>> > On Mon, Aug 24, 2026 at 02:55:42PM +0200, Sebastian Andrzej Siewior wrote:
>> >>  #include "futex.h"
>> >> @@ -865,7 +866,10 @@ int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
>> >>  	case Q_REQUEUE_PI_DONE:
>> >>  		/* Requeue completed. Current is 'pi_blocked_on' the rtmutex */
>> >>  		pi_mutex = &q.pi_state->pi_mutex;
>> >> +
>> >
>> > 		/*
>> > 		 * Since current is doing the requeue, it cannot also be
>> > 		 * a waiter on the same futex.
>> > 		 */
>> 
>> Current is not the task doing the requeue. Current is the requeued waiter which is
>> blocked on the rtmutex.
>> 
>> Though the change log is confusing at best. The whole requeue explanation
>> is not really helpful IMO.
>> 
>> The point is that _all_ invocations of rt_mutex_schedule() must be
>> preceeded by a call to rt_mutex_pre_schedule() and followed by a call to
>> rt_mutex_post_schedule().
>> 
>> So this code simply failed to do that, which triggers the
>> lockdep_assert() in rt_mutex_schedule().
>> 
>> And it's obvious from the surrounding comments how this task got there, no?
>
> I would suggest to strip it all from the futex part, not do the flush
> and just please the assert so it keeps quiet. I did some explaining in
> the v2 and then Yao suggested
> 	https://lore.kernel.org/all/5df8a43e-11bb-4881-877d-40034c414984@huawei.com/

That makes sense.

  reply	other threads:[~2026-08-27 12:32 UTC|newest]

Thread overview: 10+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-08-24 12:55 [PATCH v3 0/2] futex: Address two futex-requeue-pi issues Sebastian Andrzej Siewior
2026-08-24 12:55 ` [PATCH v3 1/2] futex: Add missing rt_mutex_.*_schedule() around rt_mutex_wait_proxy_lock() Sebastian Andrzej Siewior
2026-08-24 13:23   ` Peter Zijlstra
2026-08-24 14:09     ` Sebastian Andrzej Siewior
2026-08-26 18:06     ` Thomas Gleixner
2026-08-27  8:37       ` Sebastian Andrzej Siewior
2026-08-27 12:31         ` Thomas Gleixner [this message]
2026-09-04  5:43         ` Thomas Gleixner
2026-09-04  5:45           ` Thomas Gleixner
2026-08-24 12:55 ` [PATCH v3 2/2] futex: Prevent rcuwait use-after-free during requeue PI Sebastian Andrzej Siewior

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=87mru7g2wz.ffs@fw13 \
    --to=tglx@linutronix.de \
    --cc=andrealmeid@igalia.com \
    --cc=bigeasy@linutronix.de \
    --cc=bp@alien8.de \
    --cc=dave@stgolabs.net \
    --cc=dvhart@infradead.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mingo@redhat.com \
    --cc=peterz@infradead.org \
    --cc=yaokai34@huawei.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.