linux-kernel - Re: futex+io_uring: futex_q::task can maybe be dangling (but is not actually accessed, so it's fine)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250113143832.GH5388@noisy.programming.kicks-ass.net>
Date: Mon, 13 Jan 2025 15:38:32 +0100
From: Peter Zijlstra <peterz@...radead.org>
To: Jens Axboe <axboe@...nel.dk>
Cc: Jann Horn <jannh@...gle.com>, Thomas Gleixner <tglx@...utronix.de>,
	Ingo Molnar <mingo@...hat.com>, Darren Hart <dvhart@...radead.org>,
	Davidlohr Bueso <dave@...olabs.net>,
	André Almeida <andrealmeid@...lia.com>,
	kernel list <linux-kernel@...r.kernel.org>,
	Pavel Begunkov <asml.silence@...il.com>,
	io-uring <io-uring@...r.kernel.org>
Subject: Re: futex+io_uring: futex_q::task can maybe be dangling (but is not
 actually accessed, so it's fine)

On Fri, Jan 10, 2025 at 08:33:34PM -0700, Jens Axboe wrote:

> @@ -548,7 +549,7 @@ void __futex_queue(struct futex_q *q, struct futex_hash_bucket *hb)
>  
>  	plist_node_init(&q->list, prio);
>  	plist_add(&q->list, &hb->chain);
> -	q->task = current;
> +	q->task = task;
>  }
>  
>  /**

The alternative is, I suppose, to move the q->task assignment out to
these two callsites instead. Thomas, any opinions?

> @@ -303,7 +304,7 @@ extern int futex_unqueue(struct futex_q *q);
>  static inline void futex_queue(struct futex_q *q, struct futex_hash_bucket *hb)
>  	__releases(&hb->lock)
>  {
> -	__futex_queue(q, hb);
> +	__futex_queue(q, hb, current);
>  	spin_unlock(&hb->lock);
>  }
>  
> diff --git a/kernel/futex/pi.c b/kernel/futex/pi.c
> index d62cca5ed8f4..635c7d5d4222 100644
> --- a/kernel/futex/pi.c
> +++ b/kernel/futex/pi.c
> @@ -982,7 +982,7 @@ int futex_lock_pi(u32 __user *uaddr, unsigned int flags, ktime_t *time, int tryl
>  	/*
>  	 * Only actually queue now that the atomic ops are done:
>  	 */
> -	__futex_queue(&q, hb);
> +	__futex_queue(&q, hb, current);
>  
>  	if (trylock) {
>  		ret = rt_mutex_futex_trylock(&q.pi_state->pi_mutex);
> 
> -- 
> Jens Axboe