| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20260114110828.GE830229@noisy.programming.kicks-ass.net>
Date: Wed, 14 Jan 2026 12:08:28 +0100
From: Peter Zijlstra <peterz@...radead.org>
To: Sebastian Andrzej Siewior <bigeasy@...utronix.de>
Cc: kernel test robot <lkp@...el.com>, oe-kbuild-all@...ts.linux.dev,
linux-kernel@...r.kernel.org, Marco Elver <elver@...gle.com>
Subject: Re: kernel/futex/core.c:505:38: sparse: sparse: cast removes address
space '__user' of expression
On Wed, Jan 14, 2026 at 10:35:17AM +0100, Sebastian Andrzej Siewior wrote:
> On 2026-01-13 20:39:19 [+0100], Peter Zijlstra wrote:
> > tip/locking/core removes all the sparse lock annotations in favour of
> > clang-22 tcsan.
>
> So this is what salvation looks like?
:-)
This seems to build for me. It is the bare basic conversion, without
making use of the fancy __guarded_by() stuff for variables.
---
diff --git a/kernel/futex/Makefile b/kernel/futex/Makefile
index b77188d1fa07..9242110a32e2 100644
--- a/kernel/futex/Makefile
+++ b/kernel/futex/Makefile
@@ -1,3 +1,9 @@
# SPDX-License-Identifier: GPL-2.0
+CONTEXT_ANALYSIS_core.o := y
+CONTEXT_ANALYSIS_syscalls.o := y
+CONTEXT_ANALYSIS_pi.o := y
+CONTEXT_ANALYSIS_requeue.o := y
+CONTEXT_ANALYSIS_waitwake.o := y
+
obj-y += core.o syscalls.o pi.o requeue.o waitwake.o
diff --git a/kernel/futex/core.c b/kernel/futex/core.c
index cf7e610eac42..36fe2add982b 100644
--- a/kernel/futex/core.c
+++ b/kernel/futex/core.c
@@ -864,7 +864,6 @@ void __futex_unqueue(struct futex_q *q)
/* The key must be already stored in q->key. */
void futex_q_lock(struct futex_q *q, struct futex_hash_bucket *hb)
- __acquires(&hb->lock)
{
/*
* Increment the counter before taking the lock so that
@@ -879,10 +878,10 @@ void futex_q_lock(struct futex_q *q, struct futex_hash_bucket *hb)
q->lock_ptr = &hb->lock;
spin_lock(&hb->lock);
+ __acquire_ctx_lock(q->lock_ptr);
}
void futex_q_unlock(struct futex_hash_bucket *hb)
- __releases(&hb->lock)
{
futex_hb_waiters_dec(hb);
spin_unlock(&hb->lock);
@@ -1443,12 +1442,15 @@ static void futex_cleanup(struct task_struct *tsk)
void futex_exit_recursive(struct task_struct *tsk)
{
/* If the state is FUTEX_STATE_EXITING then futex_exit_mutex is held */
- if (tsk->futex_state == FUTEX_STATE_EXITING)
+ if (tsk->futex_state == FUTEX_STATE_EXITING) {
+ lockdep_assert_held(&tsk->futex_exit_mutex);
mutex_unlock(&tsk->futex_exit_mutex);
+ }
tsk->futex_state = FUTEX_STATE_DEAD;
}
static void futex_cleanup_begin(struct task_struct *tsk)
+ __acquires(&tsk->futex_exit_mutex)
{
/*
* Prevent various race issues against a concurrent incoming waiter
@@ -1475,6 +1477,7 @@ static void futex_cleanup_begin(struct task_struct *tsk)
}
static void futex_cleanup_end(struct task_struct *tsk, int state)
+ __releases(&tsk->futex_exit_mutex)
{
/*
* Lockless store. The only side effect is that an observer might
diff --git a/kernel/futex/futex.h b/kernel/futex/futex.h
index 30c2afa03889..7f0944683e43 100644
--- a/kernel/futex/futex.h
+++ b/kernel/futex/futex.h
@@ -217,7 +217,7 @@ enum futex_access {
extern int get_futex_key(u32 __user *uaddr, unsigned int flags, union futex_key *key,
enum futex_access rw);
-extern void futex_q_lockptr_lock(struct futex_q *q);
+extern void futex_q_lockptr_lock(struct futex_q *q) __acquires(q->lock_ptr);
extern struct hrtimer_sleeper *
futex_setup_timer(ktime_t *time, struct hrtimer_sleeper *timeout,
int flags, u64 range_ns);
@@ -311,9 +311,11 @@ extern int futex_unqueue(struct futex_q *q);
static inline void futex_queue(struct futex_q *q, struct futex_hash_bucket *hb,
struct task_struct *task)
__releases(&hb->lock)
+ __releases(q->lock_ptr)
{
__futex_queue(q, hb, task);
spin_unlock(&hb->lock);
+ __release_ctx_lock(q->lock_ptr);
}
extern void futex_unqueue_pi(struct futex_q *q);
@@ -358,9 +360,12 @@ static inline int futex_hb_waiters_pending(struct futex_hash_bucket *hb)
#endif
}
-extern void futex_q_lock(struct futex_q *q, struct futex_hash_bucket *hb);
-extern void futex_q_unlock(struct futex_hash_bucket *hb);
+extern void futex_q_lock(struct futex_q *q, struct futex_hash_bucket *hb)
+ __acquires(&hb->lock)
+ __acquires(q->lock_ptr);
+extern void futex_q_unlock(struct futex_hash_bucket *hb)
+ __releases(&hb->lock);
extern int futex_lock_pi_atomic(u32 __user *uaddr, struct futex_hash_bucket *hb,
union futex_key *key,
@@ -379,6 +384,9 @@ extern int fixup_pi_owner(u32 __user *uaddr, struct futex_q *q, int locked);
*/
static inline void
double_lock_hb(struct futex_hash_bucket *hb1, struct futex_hash_bucket *hb2)
+ __acquires(&hb1->lock)
+ __acquires(&hb2->lock)
+ __no_context_analysis
{
if (hb1 > hb2)
swap(hb1, hb2);
@@ -390,10 +398,16 @@ double_lock_hb(struct futex_hash_bucket *hb1, struct futex_hash_bucket *hb2)
static inline void
double_unlock_hb(struct futex_hash_bucket *hb1, struct futex_hash_bucket *hb2)
+ __releases(&hb1->lock)
+ __releases(&hb2->lock)
+ __no_context_analysis
{
+ lockdep_assert_held(&hb1->lock);
spin_unlock(&hb1->lock);
- if (hb1 != hb2)
+ if (hb1 != hb2) {
+ lockdep_assert_held(&hb2->lock);
spin_unlock(&hb2->lock);
+ }
}
/* syscalls */
diff --git a/kernel/futex/pi.c b/kernel/futex/pi.c
index dacb2330f1fb..80b3b92dadf4 100644
--- a/kernel/futex/pi.c
+++ b/kernel/futex/pi.c
@@ -614,6 +614,8 @@ int futex_lock_pi_atomic(u32 __user *uaddr, struct futex_hash_bucket *hb,
static int wake_futex_pi(u32 __user *uaddr, u32 uval,
struct futex_pi_state *pi_state,
struct rt_mutex_waiter *top_waiter)
+ __must_hold(&pi_state->pi_mutex.wait_lock)
+ __releases(&pi_state->pi_mutex.wait_lock)
{
struct task_struct *new_owner;
bool postunlock = false;
@@ -670,6 +672,8 @@ static int wake_futex_pi(u32 __user *uaddr, u32 uval,
static int __fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q,
struct task_struct *argowner)
+ __must_hold(&q->pi_state->pi_mutex.wait_lock)
+ __must_hold(q->lock_ptr)
{
struct futex_pi_state *pi_state = q->pi_state;
struct task_struct *oldowner, *newowner;
@@ -966,6 +970,7 @@ int futex_lock_pi(u32 __user *uaddr, unsigned int flags, ktime_t *time, int tryl
* - EAGAIN: The user space value changed.
*/
futex_q_unlock(hb);
+ __release_ctx_lock(q.lock_ptr);
/*
* Handle the case where the owner is in the middle of
* exiting. Wait for the exit to complete otherwise
@@ -1090,6 +1095,7 @@ int futex_lock_pi(u32 __user *uaddr, unsigned int flags, ktime_t *time, int tryl
if (res)
ret = (res < 0) ? res : 0;
+ __release_ctx_lock(&hb->lock);
futex_unqueue_pi(&q);
spin_unlock(q.lock_ptr);
if (q.drop_hb_ref) {
@@ -1101,10 +1107,12 @@ int futex_lock_pi(u32 __user *uaddr, unsigned int flags, ktime_t *time, int tryl
out_unlock_put_key:
futex_q_unlock(hb);
+ __release_ctx_lock(q.lock_ptr);
goto out;
uaddr_faulted:
futex_q_unlock(hb);
+ __release_ctx_lock(q.lock_ptr);
ret = fault_in_user_writeable(uaddr);
if (ret)
diff --git a/kernel/futex/waitwake.c b/kernel/futex/waitwake.c
index 1c2dd03f11ec..09b636cbc3d0 100644
--- a/kernel/futex/waitwake.c
+++ b/kernel/futex/waitwake.c
@@ -462,6 +462,7 @@ int futex_wait_multiple_setup(struct futex_vector *vs, int count, int *woken)
}
futex_q_unlock(hb);
+ __release_ctx_lock(q->lock_ptr);
}
__set_current_state(TASK_RUNNING);
@@ -628,6 +629,7 @@ int futex_wait_setup(u32 __user *uaddr, u32 val, unsigned int flags,
if (ret) {
futex_q_unlock(hb);
+ __release_ctx_lock(q->lock_ptr);
ret = get_user(uval, uaddr);
if (ret)
@@ -641,11 +643,13 @@ int futex_wait_setup(u32 __user *uaddr, u32 val, unsigned int flags,
if (uval != val) {
futex_q_unlock(hb);
+ __release_ctx_lock(q->lock_ptr);
return -EWOULDBLOCK;
}
if (key2 && futex_match(&q->key, key2)) {
futex_q_unlock(hb);
+ __release_ctx_lock(q->lock_ptr);
return -EINVAL;
}
Powered by blists - more mailing lists