[PATCH v3 0/2] futex: Canonicalize arm64 tagged user addresses

[PATCH v3 0/2] futex: Canonicalize arm64 tagged user addresses

[Shubhang Kaushik (Ampere)]

Changes in v3:
- Split the stable-targeted futex fix from its selftest, so the
  selftest patch is not Cc'd to stable.
- Add Davidlohr Bueso's Acked-by tag to the futex fix.

Link to v2: https://lore.kernel.org/r/20261030-futex-tagged-uaddr-v2-prep-v2-1-131eb7414bda@gentwo.org

Signed-off-by: Shubhang Kaushik (Ampere) <sh@gentwo.org>
---
Shubhang Kaushik (Ampere) (2):
      futex: Canonicalize arm64 tagged user addresses
      selftests/futex: Test tagged arm64 futex addresses

 kernel/futex/core.c                                |  2 +
 .../testing/selftests/futex/functional/.gitignore  |  1 +
 tools/testing/selftests/futex/functional/Makefile  |  1 +
 .../selftests/futex/functional/futex_tagged_addr.c | 61 ++++++++++++++++++++++
 tools/testing/selftests/futex/functional/run.sh    |  3 ++
 5 files changed, 68 insertions(+)
---
base-commit: 7475ea8b58616b33c04afb976cf0fbaad9dd63fb
change-id: 20261030-futex-tagged-uaddr-v2-prep-63ea40b5a22f

Best regards,
-- 
Shubhang Kaushik (Ampere) <sh@gentwo.org>

[PATCH v3 1/2] futex: Canonicalize arm64 tagged user addresses

[Shubhang Kaushik (Ampere)]

On arm64, a thread that enables the tagged address ABI can pass valid
top-byte-tagged user pointers to futex syscalls. Such a pointer must
have the same syscall behaviour as its untagged form.

get_futex_key() validates the user address with access_ok(), but uses
the raw address when constructing private and shared-anonymous futex
keys. A waiter using a tagged address and a waker using the untagged
form can therefore access the same futex word while hashing to distinct
keys, causing FUTEX_WAKE to miss the waiter.

Keep access_ok() on the original pointer so that arm64 retains its
per-thread tagged-address ABI enforcement. Canonicalize the address
afterwards, before it is used for futex key construction and shared
mapping lookup.

Fixes: 63f0c6037965 ("arm64: Introduce prctl() options to control the tagged user addresses ABI")
Cc: stable@vger.kernel.org
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Acked-by: Davidlohr Bueso <dave@stgolabs.net>
Signed-off-by: Shubhang Kaushik (Ampere) <sh@gentwo.org>
---
 kernel/futex/core.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/kernel/futex/core.c b/kernel/futex/core.c
index a240638f69e5c65bd036434a15f3df680efb4638..dcc8ffca38595a5ea69f3672375ffb9f9c6766f9 100644
--- a/kernel/futex/core.c
+++ b/kernel/futex/core.c
@@ -539,6 +539,8 @@ int get_futex_key(u32 __user *uaddr, unsigned int flags, union futex_key *key,
 	if (unlikely(!access_ok(uaddr, size)))
 		return -EFAULT;
 
+	address = untagged_addr(address);
+
 	if (unlikely(should_fail_futex(fshared)))
 		return -EFAULT;
 

-- 
2.52.0

Re: [PATCH v3 1/2] futex: Canonicalize arm64 tagged user addresses

[Catalin Marinas]

On Mon, Nov 09, 2026 at 10:26:47AM -0800, Shubhang Kaushik (Ampere) wrote:
> On arm64, a thread that enables the tagged address ABI can pass valid
> top-byte-tagged user pointers to futex syscalls. Such a pointer must
> have the same syscall behaviour as its untagged form.
> 
> get_futex_key() validates the user address with access_ok(), but uses
> the raw address when constructing private and shared-anonymous futex
> keys. A waiter using a tagged address and a waker using the untagged
> form can therefore access the same futex word while hashing to distinct
> keys, causing FUTEX_WAKE to miss the waiter.
> 
> Keep access_ok() on the original pointer so that arm64 retains its
> per-thread tagged-address ABI enforcement. Canonicalize the address
> afterwards, before it is used for futex key construction and shared
> mapping lookup.
> 
> Fixes: 63f0c6037965 ("arm64: Introduce prctl() options to control the tagged user addresses ABI")
> Cc: stable@vger.kernel.org
> Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
> Acked-by: Davidlohr Bueso <dave@stgolabs.net>
> Signed-off-by: Shubhang Kaushik (Ampere) <sh@gentwo.org>
> ---
>  kernel/futex/core.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/kernel/futex/core.c b/kernel/futex/core.c
> index a240638f69e5c65bd036434a15f3df680efb4638..dcc8ffca38595a5ea69f3672375ffb9f9c6766f9 100644
> --- a/kernel/futex/core.c
> +++ b/kernel/futex/core.c
> @@ -539,6 +539,8 @@ int get_futex_key(u32 __user *uaddr, unsigned int flags, union futex_key *key,
>  	if (unlikely(!access_ok(uaddr, size)))
>  		return -EFAULT;
>  
> +	address = untagged_addr(address);
> +
>  	if (unlikely(should_fail_futex(fshared)))
>  		return -EFAULT;

Thomas, Peter, do you plan to take this fix via tip or you'd rather we
take it via arm64? TBH, I don't think it's urgent, the bug has been
around since 2019.

Thanks.

-- 
Catalin