* [PATCH v3 1/2] futex: Canonicalize arm64 tagged user addresses
2026-11-09 18:26 [PATCH v3 0/2] futex: Canonicalize arm64 tagged user addresses Shubhang Kaushik (Ampere)
@ 2026-11-09 18:26 ` Shubhang Kaushik (Ampere)
2026-11-12 17:34 ` Catalin Marinas
2026-11-09 18:26 ` [PATCH v3 2/2] selftests/futex: Test tagged arm64 futex addresses Shubhang Kaushik (Ampere)
1 sibling, 1 reply; 4+ messages in thread
From: Shubhang Kaushik (Ampere) @ 2026-11-09 18:26 UTC (permalink / raw)
To: Thomas Gleixner, Ingo Molnar, Peter Zijlstra, Darren Hart,
Davidlohr Bueso, André Almeida, Shuah Khan, Kees Cook,
Shubhang Kaushik, Christoph Lameter (Ampere), Catalin Marinas,
Andrey Konovalov, Will Deacon
Cc: linux-kernel, linux-kselftest, Shubhang Kaushik (Ampere), stable
On arm64, a thread that enables the tagged address ABI can pass valid
top-byte-tagged user pointers to futex syscalls. Such a pointer must
have the same syscall behaviour as its untagged form.
get_futex_key() validates the user address with access_ok(), but uses
the raw address when constructing private and shared-anonymous futex
keys. A waiter using a tagged address and a waker using the untagged
form can therefore access the same futex word while hashing to distinct
keys, causing FUTEX_WAKE to miss the waiter.
Keep access_ok() on the original pointer so that arm64 retains its
per-thread tagged-address ABI enforcement. Canonicalize the address
afterwards, before it is used for futex key construction and shared
mapping lookup.
Fixes: 63f0c6037965 ("arm64: Introduce prctl() options to control the tagged user addresses ABI")
Cc: stable@vger.kernel.org
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Acked-by: Davidlohr Bueso <dave@stgolabs.net>
Signed-off-by: Shubhang Kaushik (Ampere) <sh@gentwo.org>
---
kernel/futex/core.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/kernel/futex/core.c b/kernel/futex/core.c
index a240638f69e5c65bd036434a15f3df680efb4638..dcc8ffca38595a5ea69f3672375ffb9f9c6766f9 100644
--- a/kernel/futex/core.c
+++ b/kernel/futex/core.c
@@ -539,6 +539,8 @@ int get_futex_key(u32 __user *uaddr, unsigned int flags, union futex_key *key,
if (unlikely(!access_ok(uaddr, size)))
return -EFAULT;
+ address = untagged_addr(address);
+
if (unlikely(should_fail_futex(fshared)))
return -EFAULT;
--
2.52.0
^ permalink raw reply related [flat|nested] 4+ messages in thread* [PATCH v3 2/2] selftests/futex: Test tagged arm64 futex addresses
2026-11-09 18:26 [PATCH v3 0/2] futex: Canonicalize arm64 tagged user addresses Shubhang Kaushik (Ampere)
2026-11-09 18:26 ` [PATCH v3 1/2] " Shubhang Kaushik (Ampere)
@ 2026-11-09 18:26 ` Shubhang Kaushik (Ampere)
1 sibling, 0 replies; 4+ messages in thread
From: Shubhang Kaushik (Ampere) @ 2026-11-09 18:26 UTC (permalink / raw)
To: Thomas Gleixner, Ingo Molnar, Peter Zijlstra, Darren Hart,
Davidlohr Bueso, André Almeida, Shuah Khan, Kees Cook,
Shubhang Kaushik, Christoph Lameter (Ampere), Catalin Marinas,
Andrey Konovalov, Will Deacon
Cc: linux-kernel, linux-kselftest, Shubhang Kaushik (Ampere)
On arm64, a thread that enables the tagged address ABI can use a
top-byte-tagged futex address. Verify that a waiter using such an
address is woken through the equivalent untagged address.
The test retries the wake briefly while the waiter queues, avoiding a
dependency on /proc/<tid>/wchan.
Signed-off-by: Shubhang Kaushik (Ampere) <sh@gentwo.org>
---
.../testing/selftests/futex/functional/.gitignore | 1 +
tools/testing/selftests/futex/functional/Makefile | 1 +
.../selftests/futex/functional/futex_tagged_addr.c | 61 ++++++++++++++++++++++
tools/testing/selftests/futex/functional/run.sh | 3 ++
4 files changed, 66 insertions(+)
diff --git a/tools/testing/selftests/futex/functional/.gitignore b/tools/testing/selftests/futex/functional/.gitignore
index 7c39d10b38e4d86096d2d1ce5fe8d6036e8ca758..c64b93a683bd6e9f6b9d3e4f02397eb24cc5a0ad 100644
--- a/tools/testing/selftests/futex/functional/.gitignore
+++ b/tools/testing/selftests/futex/functional/.gitignore
@@ -6,6 +6,7 @@ futex_requeue
futex_requeue_pi
futex_requeue_pi_mismatched_ops
futex_requeue_pi_signal_restart
+futex_tagged_addr
futex_wait
futex_wait_private_mapped_file
futex_wait_timeout
diff --git a/tools/testing/selftests/futex/functional/Makefile b/tools/testing/selftests/futex/functional/Makefile
index a03bd5acba50319f08b04ff0904ef155c000fee3..8f7f6730285b725b483787362db4626c459d65c9 100644
--- a/tools/testing/selftests/futex/functional/Makefile
+++ b/tools/testing/selftests/futex/functional/Makefile
@@ -19,6 +19,7 @@ TEST_GEN_PROGS := \
futex_requeue_pi \
futex_requeue_pi_signal_restart \
futex_requeue_pi_mismatched_ops \
+ futex_tagged_addr \
futex_wait_uninitialized_heap \
futex_wait_private_mapped_file \
futex_wait \
diff --git a/tools/testing/selftests/futex/functional/futex_tagged_addr.c b/tools/testing/selftests/futex/functional/futex_tagged_addr.c
new file mode 100644
index 0000000000000000000000000000000000000000..0b0e350eff11939e42b7b1aca01136b037ed7217
--- /dev/null
+++ b/tools/testing/selftests/futex/functional/futex_tagged_addr.c
@@ -0,0 +1,61 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include <errno.h>
+#include <stdint.h>
+#include <string.h>
+#include <sys/prctl.h>
+#include <time.h>
+#include <unistd.h>
+
+#include <linux/prctl.h>
+
+#include "futextest.h"
+#include "futex_thread.h"
+#include "kselftest_harness.h"
+
+#define WAKE_RETRIES 100
+#define WAKE_WAIT_US 10000
+
+#if defined(__aarch64__) && __SIZEOF_POINTER__ == 8
+static futex_t futex;
+static futex_t *tagged_futex;
+
+static int waiterfn(void *arg)
+{
+ struct timespec timeout = { .tv_sec = 2 };
+
+ return futex_wait(tagged_futex, 0, &timeout, FUTEX_PRIVATE_FLAG);
+}
+#endif
+
+TEST(tagged_addr)
+{
+#if !defined(__aarch64__) || __SIZEOF_POINTER__ != 8
+ SKIP(return, "arm64 64-bit tagged address ABI not available");
+#else
+ struct futex_thread waiter;
+ int ret, i;
+
+ ret = prctl(PR_SET_TAGGED_ADDR_CTRL, PR_TAGGED_ADDR_ENABLE, 0, 0, 0);
+ if (ret && errno == EINVAL)
+ SKIP(return, "tagged address ABI not available");
+ ASSERT_EQ(ret, 0)
+ TH_LOG("PR_SET_TAGGED_ADDR_CTRL failed: %s", strerror(errno));
+
+ tagged_futex = (futex_t *)((uintptr_t)&futex | (0x42ULL << 56));
+ ASSERT_EQ(futex_thread_create(&waiter, waiterfn, NULL), 0)
+ TH_LOG("pthread_create failed");
+
+ for (i = 0; i < WAKE_RETRIES; i++) {
+ ret = futex_wake(&futex, 1, FUTEX_PRIVATE_FLAG);
+ if (ret)
+ break;
+ usleep(WAKE_WAIT_US);
+ }
+
+ EXPECT_EQ(ret, 1);
+ EXPECT_EQ(futex_thread_destroy(&waiter), 0);
+#endif
+}
+
+TEST_HARNESS_MAIN
diff --git a/tools/testing/selftests/futex/functional/run.sh b/tools/testing/selftests/futex/functional/run.sh
index d1a681b798bd385570710e7c5f9bb28cca64de3e..620d13ee7171e7cc6061053750c9ff4cf525ff72 100755
--- a/tools/testing/selftests/futex/functional/run.sh
+++ b/tools/testing/selftests/futex/functional/run.sh
@@ -46,6 +46,9 @@ echo
echo
./futex_waitv
+echo
+./futex_tagged_addr
+
echo
./futex_priv_hash
--
2.52.0
^ permalink raw reply related [flat|nested] 4+ messages in thread