Commit cffcf520 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'locking-urgent-2026-05-03' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 

Pull locking fix from Ingo Molnar:
 "Fix lockup in requeue-PI during signal/timeout wakeups, by Sebastian
  Andrzej Siewior"

* tag 'locking-urgent-2026-05-03' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  futex: Prevent lockup in requeue-PI during signal/ timeout wakeup
parents c3cba36b bc7304f3

kernel/futex/requeue.c

+9 −4
Original line number Diff line number Diff line
@@ -319,8 +319,11 @@ futex_proxy_trylock_atomic(u32 __user *pifutex, struct futex_hash_bucket *hb1, 
		return -EINVAL;



	/* Ensure that this does not race against an early wakeup */

	if (!futex_requeue_pi_prepare(top_waiter, NULL))

	if (!futex_requeue_pi_prepare(top_waiter, NULL)) {

		plist_del(&top_waiter->list, &hb1->chain);

		futex_hb_waiters_dec(hb1);

		return -EAGAIN;

	}



	/*

	 * Try to take the lock for top_waiter and set the FUTEX_WAITERS bit
@@ -722,10 +725,12 @@ int handle_early_requeue_pi_wakeup(struct futex_hash_bucket *hb, 


	/*

	 * We were woken prior to requeue by a timeout or a signal.

	 * Unqueue the futex_q and determine which it was.

	 * Conditionally unqueue the futex_q and determine which it was.

	 */

	if (!plist_node_empty(&q->list)) {

		plist_del(&q->list, &hb->chain);

		futex_hb_waiters_dec(hb);

	}



	/* Handle spurious wakeups gracefully */

	ret = -EWOULDBLOCK;