kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
No description
1,080,163 commits 116 branches 5,798 tags 5.6 GiB
  • C 96.9%
  • Assembly 0.9%
  • Rust 0.6%
  • Shell 0.6%
  • Python 0.5%
  • Other 0.3%
Find a file
Sebastian Andrzej Siewior e5dbae3572 futex: Prevent lockup in requeue-PI during signal/ timeout wakeup 
[ Upstream commit bc7304f3ae ]

During wait-requeue-pi (task A) and requeue-PI (task B) the following
race can happen:

     Task A                             Task B
  futex_wait_requeue_pi()
    futex_setup_timer()
    futex_do_wait()
                                   futex_requeue()
                                        CLASS(hb, hb1)(&key1);
                                        CLASS(hb, hb2)(&key2);
        *timeout*
    futex_requeue_pi_wakeup_sync()
        requeue_state = Q_REQUEUE_PI_IGNORE

    *blocks on hb->lock*

                                        futex_proxy_trylock_atomic()
                                          futex_requeue_pi_prepare()
                                            Q_REQUEUE_PI_IGNORE => -EAGAIN
                                        double_unlock_hb(hb1, hb2)
                                         *retry*

Task B acquires both hb locks and attempts to acquire the PI-lock of the
top most waiter (task B). Task A is leaving early due to a signal/
timeout and started removing itself from the queue. It updates its
requeue_state but can not remove it from the list because this requires
the hb lock which is owned by task B.

Usually task A is able to swoop the lock after task B unlocked it.
However if task B is of higher priority then task A may not be able to
wake up in time and acquire the lock before task B gets it again.
Especially on a UP system where A is never scheduled.

As a result task A blocks on the lock and task B busy loops, trying to
make progress but live locks the system instead. Tragic.

This can be fixed by removing the top most waiter from the list in this
case. This allows task B to grab the next top waiter (if any) in the
next iteration and make progress.

Remove the top most waiter if futex_requeue_pi_prepare() fails.
Let the waiter conditionally remove itself from the list in
handle_early_requeue_pi_wakeup().

Fixes: 07d91ef510 ("futex: Prevent requeue_pi() lock nesting issue on RT")
Reported-by: Moritz Klammler <Moritz.Klammler@ferchau.com>
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260428103425.dywXyPd3@linutronix.de
Closes: https://lore.kernel.org/all/VE1PR06MB6894BE61C173D802365BE19DFF4CA@VE1PR06MB6894.eurprd06.prod.outlook.com
[cmllamas: adapt to 5.15, apply hunk to kernel/futex/core.c prior to the
 requeue code split and use hb_waiters_dec() before the helper rename]
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2026-08-19 17:13:51 +02:00
arch x86/bugs: Make Safe-RET robust against interrupt injection 2026-08-07 08:07:31 +02:00
block partitions: aix: bound the pp_count scan to the ppe array 2026-07-24 15:51:24 +02:00
certs X.509: Fix validation of ASN.1 certificate header 2026-07-24 15:51:59 +02:00
crypto crypto: rng - Free default RNG on module exit 2026-07-24 15:51:35 +02:00
Documentation PCI: Move Resizable BAR code to rebar.c 2026-07-24 15:51:58 +02:00
drivers nvmet-tcp: Fix potential UAF when ddgst mismatch 2026-08-19 17:13:51 +02:00
fs btrfs: fix incorrect buffered IO fallback for append direct writes 2026-07-24 15:52:02 +02:00
include Bluetooth: L2CAP: Fix regressions caused by reusing ident 2026-07-24 15:52:02 +02:00
init randomize_kstack: Maintain kstack_offset per task 2026-06-19 13:33:41 +02:00
io_uring io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item 2026-07-24 15:51:21 +02:00
ipc ipc/shm: serialize orphan cleanup with shm_nattch updates 2026-06-19 13:33:38 +02:00
kernel futex: Prevent lockup in requeue-PI during signal/ timeout wakeup 2026-08-19 17:13:51 +02:00
lib lib/test_meminit: use && for bools 2026-07-24 15:51:32 +02:00
LICENSES LICENSES/dual/CC-BY-4.0: Git rid of "smart quotes" 2021-07-15 06:31:24 -06:00
mm mm/huge_memory: update file PMD counter before folio_put() 2026-06-19 13:33:49 +02:00
net Bluetooth: L2CAP: Fix regressions caused by reusing ident 2026-07-24 15:52:02 +02:00
samples tracing/events: Fix to check the simple_tsk_fn creation 2026-07-24 15:51:42 +02:00
scripts kconfig: fix potential NULL pointer dereference in conf_askvalue 2026-07-24 15:51:28 +02:00
security apparmor: fix label can not be immediately before a declaration 2026-07-24 15:51:39 +02:00
sound ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() 2026-07-24 15:52:02 +02:00
tools bitops: make BYTES_TO_BITS() treewide-available 2026-07-24 15:51:56 +02:00
usr kbuild: hdrcheck: fix cross build with clang 2025-06-27 11:05:22 +01:00
virt KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers 2026-07-24 15:52:02 +02:00
.clang-format clang-format: Update with the latest for_each macro list 2021-05-12 23:32:39 +02:00
.cocciconfig scripts: add Linux .cocciconfig for coccinelle 2016-07-22 12:13:39 +02:00
.get_maintainer.ignore Opt out of scripts/get_maintainer.pl 2019-05-16 10:53:40 -07:00
.gitattributes .gitattributes: use 'dts' diff driver for dts files 2019-12-04 19:44:11 -08:00
.gitignore Remove *.orig pattern from .gitignore 2024-10-17 15:11:10 +02:00
.mailmap mailmap: add Andrej Shadura 2021-10-18 20:22:03 -10:00
COPYING COPYING: state that all contributions really are covered by this file 2020-02-10 13:32:20 -08:00
CREDITS MAINTAINERS: Move Daniel Drake to credits 2021-09-21 08:34:58 +03:00
Kbuild kbuild: rename hostprogs-y/always to hostprogs/always-y 2020-02-04 01:53:07 +09:00
Kconfig kbuild: ensure full rebuild when the compiler is updated 2020-05-12 13:28:33 +09:00
MAINTAINERS staging: rtl8712: Remove driver using deprecated API wext 2025-12-07 06:09:36 +09:00
Makefile Linux 5.15.215 2026-08-07 08:07:31 +02:00
README Drop all 00-INDEX files from Documentation/ 2018-09-09 15:08:58 -06:00

README 

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.