diff options
| author | Jens Axboe <axboe@kernel.dk> | 2025-01-15 09:05:15 -0700 |
|---|---|---|
| committer | Thomas Gleixner <tglx@linutronix.de> | 2025-01-24 09:37:30 +0100 |
| commit | 5e0e02f0d7e52cfc8b1adfc778dd02181d8b47b4 (patch) | |
| tree | 585b1b169efa2c2a2d229f309a75d02e064d20c7 /kernel/futex/waitwake.c | |
| parent | Merge tag 'sched_ext-for-6.14' of git://git.kernel.org/pub/scm/linux/kernel/g... (diff) | |
| download | linux-5e0e02f0d7e52cfc8b1adfc778dd02181d8b47b4.tar.gz linux-5e0e02f0d7e52cfc8b1adfc778dd02181d8b47b4.zip | |
futex: Pass in task to futex_queue()
futex_queue() -> __futex_queue() uses 'current' as the task to store in
the struct futex_q->task field. This is fine for synchronous usage of
the futex infrastructure, but it's not always correct when used by
io_uring where the task doing the initial futex_queue() might not be
available later on. This doesn't lead to any issues currently, as the
io_uring side doesn't support PI futexes, but it does leave a
potentially dangling pointer which is never a good idea.
Have futex_queue() take a task_struct argument, and have the regular
callers pass in 'current' for that. Meanwhile io_uring can just pass in
NULL, as the task should never be used off that path. In theory
req->tctx->task could be used here, but there's no point populating it
with a task field that will never be used anyway.
Reported-by: Jann Horn <jannh@google.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/all/22484a23-542c-4003-b721-400688a0d055@kernel.dk
Diffstat (limited to 'kernel/futex/waitwake.c')
| -rw-r--r-- | kernel/futex/waitwake.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/kernel/futex/waitwake.c b/kernel/futex/waitwake.c index 3a10375d9521..a9056acb75ee 100644 --- a/kernel/futex/waitwake.c +++ b/kernel/futex/waitwake.c @@ -350,7 +350,7 @@ void futex_wait_queue(struct futex_hash_bucket *hb, struct futex_q *q, * access to the hash list and forcing another memory barrier. */ set_current_state(TASK_INTERRUPTIBLE|TASK_FREEZABLE); - futex_queue(q, hb); + futex_queue(q, hb, current); /* Arm the timer */ if (timeout) @@ -461,7 +461,7 @@ retry: * next futex. Queue each futex at this moment so hb can * be unlocked. */ - futex_queue(q, hb); + futex_queue(q, hb, current); continue; } |