From nobody Mon Sep 28 15:34:40 2026 Received: from galois.linutronix.de (Galois.linutronix.de [193.142.43.55]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3D95947B403; Thu, 20 Aug 2026 16:31:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=193.142.43.55 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787243469; cv=none; b=H7eAylSxGDflWnxc6W7IQuOJQ2c1VwMUBHoErevUzLyW5K+sWL9uQnrbL8q46M72A7MgsX0aa3Wxh4addVcFeZmetCQiAc+rSr+Z0z0VuK/spqsbDileMwAQ1Uc8kr1PRkERIbJxlnubEhriw4c/9im1aKe9c+C0p1bvkdW7Feg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787243469; c=relaxed/simple; bh=wPRHITcl3mcAk8nh/vrNLN8MgacJuYs6jUV0ZZLL0iE=; h=Date:From:To:Subject:Cc:In-Reply-To:References:MIME-Version: Message-ID:Content-Type; b=Q1rO/VauC9wpadgUhlnCTtXSLW5Pa7OlGKH700pb2XWEDaX3dSBL38IVAlTvrW4Udx6qOS8mS414RCXE3eRWCXddQJfgi3hfginqR7lmMlAjOlT157S3eOTo0K4r5WNL7VG2fLvIS5ZI25niN5qxjTHPGpl4+0/x7kFyf1XMpio= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linutronix.de; spf=pass smtp.mailfrom=linutronix.de; dkim=pass (2048-bit key) header.d=linutronix.de header.i=@linutronix.de header.b=p6SX7r+p; dkim=permerror (0-bit key) header.d=linutronix.de header.i=@linutronix.de header.b=XGUSkYfi; arc=none smtp.client-ip=193.142.43.55 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linutronix.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linutronix.de Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=linutronix.de header.i=@linutronix.de header.b="p6SX7r+p"; dkim=permerror (0-bit key) header.d=linutronix.de header.i=@linutronix.de header.b="XGUSkYfi" Date: Thu, 20 Aug 2026 16:31:04 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1787243466; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=jP4NdZBe4eshFhmaWHrdTtITZjZ0MX8bu6G8kJk0X40=; b=p6SX7r+p2vOslcNJKfFX5GA7PY6tOmu3FfYd61X4GrWTBN7XIyGu2PqZf36yFRzOUTD5K3 Wmtgys1MiP1ocYT3sLd0AUteiuzS+g0QNqbXH4eFlnka3j7tknhHUhF/OdKqboXpu57ujy QnwDODmCuOQ8WPTFili5a6caToJoSGadSXDsOlSHPywaVsiWepbXLMC9w0nPqegbEtgJCx 23gt0tyVuv1j94Jn335sbN9zYJ0ZV4Jr6eIlQ9zkmzzUkSPzyY+kFl8BSPPkIO3zvUcopp NgNGuoFqViDfzTKyUOXC11sSbEsjA7FlrG7QnWPtObxkLknG5SMJYEPBiDOXhQ== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1787243466; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=jP4NdZBe4eshFhmaWHrdTtITZjZ0MX8bu6G8kJk0X40=; b=XGUSkYfiiqvkJkjUEz7ZQnqH5X6wlE1kg6xCyrJNCGFbsAeMldlbnmGfsMLArOcI+b8Kkx /gD4kGohKu2uLvDw== From: "tip-bot2 for Peter Zijlstra" Sender: tip-bot2@linutronix.de Reply-to: linux-kernel@vger.kernel.org To: linux-tip-commits@vger.kernel.org Subject: [tip: locking/urgent] futex: Fix might_sleep() warning in futex_pivot_pending() Cc: syzbot+350a93852ac854927f45@syzkaller.appspotmail.com, "Peter Zijlstra (Intel)" , Thomas Gleixner , x86@kernel.org, linux-kernel@vger.kernel.org In-Reply-To: <20260820074927.GH1246887@noisy.programming.kicks-ass.net> References: <20260820074927.GH1246887@noisy.programming.kicks-ass.net> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Message-ID: <178724346484.1542179.7119689236679846805.tip-bot2@tip-bot2> Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails Precedence: bulk Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable The following commit has been merged into the locking/urgent branch of tip: Commit-ID: d8aa5dd97944a72d4a9e3cc79bb80fcac7d6e829 Gitweb: https://git.kernel.org/tip/d8aa5dd97944a72d4a9e3cc79bb80fcac= 7d6e829 Author: Peter Zijlstra AuthorDate: Thu, 20 Aug 2026 09:49:27 +02:00 Committer: Thomas Gleixner CommitterDate: Thu, 20 Aug 2026 18:26:42 +02:00 futex: Fix might_sleep() warning in futex_pivot_pending() A younger me put a WARN in might_sleep() to warn about nested sleep loops. = This younger me also build a wait-loop variant that can deal with it. This wait-= loop variant doesn't have all the fancy wrappers, since it isn't used much. It a= lso lacks wait-bit support. Add the wait-bit support and use it to fix the nested wait issue. Fixes: 8e7ff730dd96 ("futex: Fix race in futex_pivot_pending() during priva= te hash resize") Reported-by: syzbot+350a93852ac854927f45@syzkaller.appspotmail.com Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260820074927.GH1246887@noisy.programming.k= icks-ass.net Closes: https://syzkaller.appspot.com/bug?extid=3D350a93852ac854927f45 --- include/linux/wait.h | 1 + include/linux/wait_bit.h | 1 + kernel/futex/core.c | 27 ++++++++++++++++++++++++++- kernel/sched/wait.c | 15 +++++++++++++++ kernel/sched/wait_bit.c | 14 +++++++++++--- 5 files changed, 54 insertions(+), 4 deletions(-) diff --git a/include/linux/wait.h b/include/linux/wait.h index dce055e..7e21533 100644 --- a/include/linux/wait.h +++ b/include/linux/wait.h @@ -1228,6 +1228,7 @@ long prepare_to_wait_event(struct wait_queue_head *wq= _head, struct wait_queue_en void finish_wait(struct wait_queue_head *wq_head, struct wait_queue_entry = *wq_entry); long wait_woken(struct wait_queue_entry *wq_entry, unsigned mode, long tim= eout); int woken_wake_function(struct wait_queue_entry *wq_entry, unsigned mode, = int sync, void *key); +int woken_wake_bit_function(struct wait_queue_entry *wq_entry, unsigned mo= de, int sync, void *key); int autoremove_wake_function(struct wait_queue_entry *wq_entry, unsigned m= ode, int sync, void *key); =20 #define DEFINE_WAIT_FUNC(name, function) \ diff --git a/include/linux/wait_bit.h b/include/linux/wait_bit.h index ace7379..553d7b2 100644 --- a/include/linux/wait_bit.h +++ b/include/linux/wait_bit.h @@ -32,6 +32,7 @@ int out_of_line_wait_on_bit_timeout(unsigned long *word, = int, wait_bit_action_f=20 int out_of_line_wait_on_bit_lock(unsigned long *word, int, wait_bit_action= _f *action, unsigned int mode); struct wait_queue_head *bit_waitqueue(unsigned long *word, int bit); extern void __init wait_bit_init(void); +extern struct wait_bit_key *__var_wake_key(struct wait_queue_entry *wq_ent= ry, void *arg); =20 int wake_bit_function(struct wait_queue_entry *wq_entry, unsigned mode, in= t sync, void *key); =20 diff --git a/kernel/futex/core.c b/kernel/futex/core.c index b38222e..f7af97c 100644 --- a/kernel/futex/core.c +++ b/kernel/futex/core.c @@ -45,6 +45,7 @@ #include #include #include +#include =20 #include =20 @@ -1884,11 +1885,35 @@ static int futex_hash_allocate(unsigned int hash_sl= ots, unsigned int flags) futex_hash_bucket_init(&fph->queues[i]); =20 if (custom) { + struct wait_bit_queue_entry __wbq_entry; + struct wait_queue_head *__wq_head; + /* * Only let prctl() wait / retry; don't unduly delay clone(). */ again: - wait_var_event(mm, futex_pivot_pending(mm)); + __wq_head =3D __var_waitqueue(mm); + init_wait_var_entry(&__wbq_entry, mm, 0); + __wbq_entry.wq_entry.func =3D woken_wake_bit_function; + add_wait_queue(__wq_head, &__wbq_entry.wq_entry); + + /* + * add_wait_queue() futex_ref_put() + * MB (this) MB (implied) + * futex_pivot_pending() wake_up_var() + * waitqueue_active() + * + * Notably, it must not be possible to see + * !futex_pivot_pending() && !waitqueue_active(). + */ + smp_mb(); + + while (!futex_pivot_pending(mm) && + wait_woken(&__wbq_entry.wq_entry, TASK_UNINTERRUPTIBLE, + MAX_SCHEDULE_TIMEOUT)) + /* empty */; + + remove_wait_queue(__wq_head, &__wbq_entry.wq_entry); } =20 scoped_guard(mutex, &mm->futex.phash.lock) { diff --git a/kernel/sched/wait.c b/kernel/sched/wait.c index 20f27e2..d033f60 100644 --- a/kernel/sched/wait.c +++ b/kernel/sched/wait.c @@ -5,6 +5,7 @@ * (C) 2004 Nadia Yvette Chambers, Oracle */ #include "sched.h" +#include =20 void __init_waitqueue_head(struct wait_queue_head *wq_head, const char *na= me, struct lock_class_key *key) { @@ -463,3 +464,17 @@ int woken_wake_function(struct wait_queue_entry *wq_en= try, unsigned mode, int sy return default_wake_function(wq_entry, mode, sync, key); } EXPORT_SYMBOL(woken_wake_function); + +int woken_wake_bit_function(struct wait_queue_entry *wq_entry, unsigned mo= de, int sync, void *arg) +{ + struct wait_bit_key *key =3D __var_wake_key(wq_entry, arg); + if (!key) + return 0; + + /* Pairs with the smp_store_mb() in wait_woken(). */ + smp_mb(); /* C */ + wq_entry->flags |=3D WQ_FLAG_WOKEN; + + return default_wake_function(wq_entry, mode, sync, key); +} +EXPORT_SYMBOL(woken_wake_bit_function); diff --git a/kernel/sched/wait_bit.c b/kernel/sched/wait_bit.c index 1088d3b..348f721 100644 --- a/kernel/sched/wait_bit.c +++ b/kernel/sched/wait_bit.c @@ -167,9 +167,7 @@ wait_queue_head_t *__var_waitqueue(void *p) } EXPORT_SYMBOL(__var_waitqueue); =20 -static int -var_wake_function(struct wait_queue_entry *wq_entry, unsigned int mode, - int sync, void *arg) +struct wait_bit_key *__var_wake_key(struct wait_queue_entry *wq_entry, voi= d *arg) { struct wait_bit_key *key =3D arg; struct wait_bit_queue_entry *wbq_entry =3D @@ -177,6 +175,16 @@ var_wake_function(struct wait_queue_entry *wq_entry, u= nsigned int mode, =20 if (wbq_entry->key.flags !=3D key->flags || wbq_entry->key.bit_nr !=3D key->bit_nr) + return NULL; + + return key; +} + +static int var_wake_function(struct wait_queue_entry *wq_entry, unsigned i= nt mode, + int sync, void *arg) +{ + struct wait_bit_key *key =3D __var_wake_key(wq_entry, arg); + if (!key) return 0; =20 return autoremove_wake_function(wq_entry, mode, sync, key);