From nobody Sat Jun 13 23:09:53 2026 Received: from toucan.tulip.relay.mailchannels.net (toucan.tulip.relay.mailchannels.net [23.83.218.254]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 782A62E5B2A for ; Tue, 5 May 2026 08:59:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=pass smtp.client-ip=23.83.218.254 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777971541; cv=pass; b=TJpX6iMlbGBbymRDuIJrl6lFyX6C0Gzd9+pzCJJtnX7c8KcjKERrup3R7MUBoZsaQ7WdXvXsCnHzBZ6SSEsO9y0WVy2TCi9aCLQ1bkSy2OqoCbFJP01G2E9X4Ha5RB6Utdwwd61mYUXM3pCNl7Qo7B+ox39JJoLkcgJiJkZWdek= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777971541; c=relaxed/simple; bh=kAOD0osjgDQ+b0fi6HxYVqsCFZ0Pr5w5xrU5rlRYdKw=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=tVLTnFd5f8CYQlQIY5sMrQ5spRdj1LhpAWJUU2Y3CR+XUwdBRJsNFJtvDsP2gl8396WBUjaLduVELRg97DQcijJsER2FL17L3zKJlDpqeyxAPJ2y73zjUgIiLj+G8IZJGesob+W+gmav0ygPLo3LTKOvNlLrckZYFxGlACiWZew= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=stgolabs.net; spf=fail smtp.mailfrom=stgolabs.net; dkim=pass (2048-bit key) header.d=stgolabs.net header.i=@stgolabs.net header.b=k1uSlPHA; arc=pass smtp.client-ip=23.83.218.254 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=stgolabs.net Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=stgolabs.net Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=stgolabs.net header.i=@stgolabs.net header.b="k1uSlPHA" X-Sender-Id: dreamhost|x-authsender|dave@stgolabs.net Received: from relay.mailchannels.net (localhost [127.0.0.1]) by relay.mailchannels.net (Postfix) with ESMTP id 284BC401C7F; Tue, 05 May 2026 08:58:54 +0000 (UTC) Received: from pdx1-sub0-mail-a219.dreamhost.com (100-96-8-23.trex-nlb.outbound.svc.cluster.local [100.96.8.23]) (Authenticated sender: dreamhost) by relay.mailchannels.net (Postfix) with ESMTPA id B7ADB400C25; Tue, 05 May 2026 08:58:53 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; d=mailchannels.net; s=arc-2022; cv=none; t=1777971533; b=aENW6dPsBeaLGFHZjPmUKNZ8QMi17Z8gxxT3TdvReu6iW227b0582SFe84CaBrmKsKnq8d k13CQncv/nMODZYQMqvCxHlqGX5BPzvMQ8bX0N6VjwJQ+ORh3UbJJtXNNC7akvQmR1oSNS bT9O7Stz/awwVDAE3vZolwkpRB2w4Y+SFXgNnSGZOgolYvJDV69wwVuHgChHX1e0QTHONU LcGrvXFmWaauTqiphsdUF4PZNh5/I8+SozHWoqAEDikk5z30xot9C1jvNUvxahNVbw7C4B tbp6mL87bf9Alr4fm52BJS6K6TzURR32gRXSnHxWtWZd7AOOrFthhhX9RUbt5g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=mailchannels.net; s=arc-2022; t=1777971533; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding:dkim-signature; bh=5esMUj/TkuhJKus0H4DN/SnnF1H8yiY029Hg81dbmCs=; b=s+KkuwjfcYpcvcWUYrfyt50I92AsSu7LNdhsGzIAygrh0x+yOr9Wz8v5iidP/C+1fiQv/O 3hJYraMXEZCSXTuQmw0ZO8N5hyAejebC81xpM6OvxmtyUhf+Shgd+KEiaTixmI70ND32k5 F4HjnK1+oH++VQTGIiDRLHK55IxG8Q9l/olZT6gCMUFJ95kLq8+nVWO85gdiB0V19ykYpR A77kwugE01rUqiRCVoX5TYSHTkdPGx7Ek9QUvm3zGHl3QtF4UYfBYFRfRLxnVqsC1Llcpp ApRv61gjh5bQSMWtMDxIR8myPmc8k0lShKJ8gypaT2+1GzEQAjsWA8oYgItWBg== ARC-Authentication-Results: i=1; rspamd-7766795c76-jv6d2; auth=pass smtp.auth=dreamhost smtp.mailfrom=dave@stgolabs.net X-Sender-Id: dreamhost|x-authsender|dave@stgolabs.net X-MC-Relay: Neutral X-MailChannels-SenderId: dreamhost|x-authsender|dave@stgolabs.net X-MailChannels-Auth-Id: dreamhost X-Lonely-Tangy: 17f2964d55dcece6_1777971534028_988924832 X-MC-Loop-Signature: 1777971534028:3808556914 X-MC-Ingress-Time: 1777971534028 Received: from pdx1-sub0-mail-a219.dreamhost.com (pop.dreamhost.com [64.90.62.162]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384) by 100.96.8.23 (trex/7.1.5); Tue, 05 May 2026 08:58:54 +0000 Received: from localhost.localdomain (unknown [213.147.98.98]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: dave@stgolabs.net) by pdx1-sub0-mail-a219.dreamhost.com (Postfix) with ESMTPSA id 4g8srB4zKfz1h; Tue, 5 May 2026 01:58:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=stgolabs.net; s=dreamhost; t=1777971533; bh=5esMUj/TkuhJKus0H4DN/SnnF1H8yiY029Hg81dbmCs=; h=From:To:Cc:Subject:Date:Content-Transfer-Encoding; b=k1uSlPHA/N4hJv9cT0MnKVN5TeQrG1D9vev1YJYXqOj7aVboICGBEqx9WCMkfyrLC UAIEXkMp8STm6uaQGNDGoFUI6uywpnlp4Jg3HO5xo7CWhGk9/nJre9yBKfB2snl5LO Q9W/ThNTqmvGDMEYgWz+OTL/zABungW8g82wDN1BzQvSkutVsPU1qD/Ysd01AA/TrJ yI+E6gBg46aqUpOs0214gIOnz4dQ4AMPPfdbIzWkGES64eWqnftf0jsEx0psOFerDf hAjTlXj14vzueuk1akLdnJar0+sV2TGYDb/xbUqD9rZVHFkwHAkknLP9lQRAXWvuKT RJEg+uGZDmb3g== From: Davidlohr Bueso To: pjw@kernel.org, palmer@dabbelt.com Cc: aou@eecs.berkeley.edu, alex@ghiti.fr, tglx@kernel.org, mingo@redhat.com, peterz@infradead.org, dvhart@infradead.org, andrealmeid@igalia.com, dave@stgolabs.net, linux-riscv@lists.infradead.org, linux-kernel@vger.kernel.org Subject: [PATCH] riscv/futex: Bound number of LL/SC retries in cmpxchg Date: Tue, 5 May 2026 01:58:35 -0700 Message-Id: <20260505085835.986669-1-dave@stgolabs.net> X-Mailer: git-send-email 2.39.5 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" futex_atomic_cmpxchg_inatomic() does an unbounded LR/SC retry loop while (minimally) holding the hb lock + pf disabled. This can lead to pathological cases from unpriviledged userspace pi operations. Bound the retry loop to (arbitrarily) 128 iterations and bail: drop locks, rechedule and retry the operation, similar to the arm64 variant, as of 03110a5cb216 ("arm64: futex: Bound number of LDXR/STXR loops in FUTEX_WAKE_= OP"). Signed-off-by: Davidlohr Bueso --- Compile tested only. arch/riscv/include/asm/futex.h | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/arch/riscv/include/asm/futex.h b/arch/riscv/include/asm/futex.h index 90c86b115e00..865701807014 100644 --- a/arch/riscv/include/asm/futex.h +++ b/arch/riscv/include/asm/futex.h @@ -13,6 +13,8 @@ #include #include =20 +#define FUTEX_MAX_LOOPS 128 + /* We don't even really need the extable code, but for now keep it simple = */ #ifndef CONFIG_MMU #define __enable_user_access() do { } while (0) @@ -77,6 +79,7 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uadd= r, u32 oldval, u32 newval) { int ret =3D 0; + unsigned int loops =3D FUTEX_MAX_LOOPS; u32 val; uintptr_t tmp; =20 @@ -85,16 +88,20 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *ua= ddr, =20 __enable_user_access(); __asm__ __volatile__ ( - "1: lr.w %[v],%[u] \n" + "1: lr.w %[v],%[u] \n" " bne %[v],%z[ov],3f \n" "2: sc.w.aqrl %[t],%z[nv],%[u] \n" - " bnez %[t],1b \n" + " beqz %[t],3f \n" + " addi %[lp],%[lp],-1 \n" + " bnez %[lp],1b \n" + " li %[r],%[eagain] \n" "3: \n" _ASM_EXTABLE_UACCESS_ERR(1b, 3b, %[r]) \ _ASM_EXTABLE_UACCESS_ERR(2b, 3b, %[r]) \ - : [r] "+r" (ret), [v] "=3D&r" (val), [u] "+m" (*uaddr), [t] "=3D&r" (tmp) - : [ov] "Jr" ((long)(int)oldval), [nv] "Jr" (newval) + : [r] "+r" (ret), [v] "=3D&r" (val), [u] "+m" (*uaddr), + [t] "=3D&r" (tmp), [lp] "+r" (loops) + : [ov] "Jr" ((long)(int)oldval), [nv] "Jr" (newval), + [eagain] "i" (-EAGAIN) : "memory"); __disable_user_access(); =20 -- 2.39.5