Commit 3f6b2330 authored by Sebastian Andrzej Siewior's avatar Sebastian Andrzej Siewior Committed by Peter Zijlstra
Browse files

futex: Acquire a hash reference in futex_wait_multiple_setup() 



futex_wait_multiple_setup() changes task_struct::__state to
!TASK_RUNNING and then enqueues on multiple futexes. Every
futex_q_lock() acquires a reference on the global hash which is
dropped later.

If a rehash is in progress then the loop will block on
mm_struct::futex_hash_bucket for the rehash to complete and this will
lose the previously set task_struct::__state.

Acquire a reference on the local hash to avoiding blocking on
mm_struct::futex_hash_bucket.

Signed-off-by: default avatarSebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lore.kernel.org/r/20250416162921.513656-9-bigeasy@linutronix.de
parent d854e4e7

kernel/futex/waitwake.c

+6 −0
Original line number Diff line number Diff line
@@ -406,6 +406,12 @@ int futex_wait_multiple_setup(struct futex_vector *vs, int count, int *woken) 
	int ret, i;

	u32 uval;



	/*

	 * Make sure to have a reference on the private_hash such that we

	 * don't block on rehash after changing the task state below.

	 */

	guard(private_hash)();



	/*

	 * Enqueuing multiple futexes is tricky, because we need to enqueue

	 * each futex on the list before dealing with the next one to avoid