Hi,

This series fixes two independent issues in the requeue PI wait path.

Patch 1 restores rtmutex scheduling preparation when the temporary
removal of futex_q during requeue causes futex_do_wait() to skip
schedule(), while the proxy waiter still has to block on the target
rtmutex.

Patch 2 prevents the requeue side from accessing the waiter's
stack-based futex_q after publishing Q_REQUEUE_PI_LOCKED. The saved-task
wakeup in requeue_pi_wake_futex() also covers a waiter blocked in the
rcuwait synchronization path.

Changes since v1:
  - Replace the scheduler helper split in patch 1 with
    rt_mutex_pre_schedule()/rt_mutex_post_schedule() directly around
    rt_mutex_wait_proxy_lock().
  - Expand patch 2's comment and changelog to explain why the saved-task
    wakeup covers rcuwait without losing a wakeup.

Thanks to Sebastian for the review and for suggesting the simpler fix
for patch 1.

v1:
  https://lore.kernel.org/r/20260717084922.4153317-1-yaokai34@huawei.com

Testing:
  - Build-tested with non-RT and PREEMPT_RT configurations.
  - The original rt_mutex_schedule() warning reproducer no longer
    triggers the warning.
  - The original PREEMPT_RT KASAN reproducer no longer reports an
    invalid access.
  - The futex requeue PI selftests and stress tests pass.

Yao

Yao Kai (2):
  futex/requeue: Fix rtmutex schedule preparation for requeue PI
  futex/requeue: Prevent rcuwait use-after-free during requeue PI

 kernel/futex/requeue.c | 20 ++++++++++++++++++--
 1 file changed, 18 insertions(+), 2 deletions(-)

-- 
2.43.0