| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20260121111213.950376128@infradead.org>
Date: Wed, 21 Jan 2026 12:07:08 +0100
From: Peter Zijlstra <peterz@...radead.org>
To: elver@...gle.com
Cc: linux-kernel@...r.kernel.org,
bigeasy@...utronix.de,
peterz@...radead.org,
mingo@...nel.org,
tglx@...utronix.de,
will@...nel.org,
boqun.feng@...il.com,
longman@...hat.com,
hch@....de,
rostedt@...dmis.org,
bvanassche@....org,
llvm@...ts.linux.dev
Subject: [RFC][PATCH 4/4] futex: Convert to compiler context analysis
Convert the sparse annotations over to the new compiler context
analysis stuff.
Signed-off-by: Peter Zijlstra (Intel) <peterz@...radead.org>
Link: https://patch.msgid.link/20260114110828.GE830229@noisy.programming.kicks-ass.net
---
kernel/futex/Makefile | 2 ++
kernel/futex/core.c | 9 ++++++---
kernel/futex/futex.h | 17 ++++++++++++++---
kernel/futex/pi.c | 9 +++++++++
kernel/futex/waitwake.c | 4 ++++
5 files changed, 35 insertions(+), 6 deletions(-)
--- a/kernel/futex/Makefile
+++ b/kernel/futex/Makefile
@@ -1,3 +1,5 @@
# SPDX-License-Identifier: GPL-2.0
+CONTEXT_ANALYSIS := y
+
obj-y += core.o syscalls.o pi.o requeue.o waitwake.o
--- a/kernel/futex/core.c
+++ b/kernel/futex/core.c
@@ -864,7 +864,6 @@ void __futex_unqueue(struct futex_q *q)
/* The key must be already stored in q->key. */
void futex_q_lock(struct futex_q *q, struct futex_hash_bucket *hb)
- __acquires(&hb->lock)
{
/*
* Increment the counter before taking the lock so that
@@ -879,10 +878,10 @@ void futex_q_lock(struct futex_q *q, str
q->lock_ptr = &hb->lock;
spin_lock(&hb->lock);
+ __acquire(q->lock_ptr);
}
void futex_q_unlock(struct futex_hash_bucket *hb)
- __releases(&hb->lock)
{
futex_hb_waiters_dec(hb);
spin_unlock(&hb->lock);
@@ -1443,12 +1442,15 @@ static void futex_cleanup(struct task_st
void futex_exit_recursive(struct task_struct *tsk)
{
/* If the state is FUTEX_STATE_EXITING then futex_exit_mutex is held */
- if (tsk->futex_state == FUTEX_STATE_EXITING)
+ if (tsk->futex_state == FUTEX_STATE_EXITING) {
+ __assume_ctx_lock(&tsk->futex_exit_mutex);
mutex_unlock(&tsk->futex_exit_mutex);
+ }
tsk->futex_state = FUTEX_STATE_DEAD;
}
static void futex_cleanup_begin(struct task_struct *tsk)
+ __acquires(&tsk->futex_exit_mutex)
{
/*
* Prevent various race issues against a concurrent incoming waiter
@@ -1475,6 +1477,7 @@ static void futex_cleanup_begin(struct t
}
static void futex_cleanup_end(struct task_struct *tsk, int state)
+ __releases(&tsk->futex_exit_mutex)
{
/*
* Lockless store. The only side effect is that an observer might
--- a/kernel/futex/futex.h
+++ b/kernel/futex/futex.h
@@ -217,7 +217,7 @@ enum futex_access {
extern int get_futex_key(u32 __user *uaddr, unsigned int flags, union futex_key *key,
enum futex_access rw);
-extern void futex_q_lockptr_lock(struct futex_q *q);
+extern void futex_q_lockptr_lock(struct futex_q *q) __acquires(q->lock_ptr);
extern struct hrtimer_sleeper *
futex_setup_timer(ktime_t *time, struct hrtimer_sleeper *timeout,
int flags, u64 range_ns);
@@ -311,9 +311,11 @@ extern int futex_unqueue(struct futex_q
static inline void futex_queue(struct futex_q *q, struct futex_hash_bucket *hb,
struct task_struct *task)
__releases(&hb->lock)
+ __releases(q->lock_ptr)
{
__futex_queue(q, hb, task);
spin_unlock(&hb->lock);
+ __release(q->lock_ptr);
}
extern void futex_unqueue_pi(struct futex_q *q);
@@ -358,9 +360,12 @@ static inline int futex_hb_waiters_pendi
#endif
}
-extern void futex_q_lock(struct futex_q *q, struct futex_hash_bucket *hb);
-extern void futex_q_unlock(struct futex_hash_bucket *hb);
+extern void futex_q_lock(struct futex_q *q, struct futex_hash_bucket *hb)
+ __acquires(&hb->lock)
+ __acquires(q->lock_ptr);
+extern void futex_q_unlock(struct futex_hash_bucket *hb)
+ __releases(&hb->lock);
extern int futex_lock_pi_atomic(u32 __user *uaddr, struct futex_hash_bucket *hb,
union futex_key *key,
@@ -379,6 +384,9 @@ extern int fixup_pi_owner(u32 __user *ua
*/
static inline void
double_lock_hb(struct futex_hash_bucket *hb1, struct futex_hash_bucket *hb2)
+ __acquires(&hb1->lock)
+ __acquires(&hb2->lock)
+ __no_context_analysis
{
if (hb1 > hb2)
swap(hb1, hb2);
@@ -390,6 +398,9 @@ double_lock_hb(struct futex_hash_bucket
static inline void
double_unlock_hb(struct futex_hash_bucket *hb1, struct futex_hash_bucket *hb2)
+ __releases(&hb1->lock)
+ __releases(&hb2->lock)
+ __no_context_analysis
{
spin_unlock(&hb1->lock);
if (hb1 != hb2)
--- a/kernel/futex/pi.c
+++ b/kernel/futex/pi.c
@@ -389,6 +389,7 @@ static void __attach_to_pi_owner(struct
* Initialize the pi_mutex in locked state and make @p
* the owner of it:
*/
+ __assume_ctx_lock(&pi_state->pi_mutex.wait_lock);
rt_mutex_init_proxy_locked(&pi_state->pi_mutex, p);
/* Store the key for possible exit cleanups: */
@@ -614,6 +615,8 @@ int futex_lock_pi_atomic(u32 __user *uad
static int wake_futex_pi(u32 __user *uaddr, u32 uval,
struct futex_pi_state *pi_state,
struct rt_mutex_waiter *top_waiter)
+ __must_hold(&pi_state->pi_mutex.wait_lock)
+ __releases(&pi_state->pi_mutex.wait_lock)
{
struct task_struct *new_owner;
bool postunlock = false;
@@ -670,6 +673,8 @@ static int wake_futex_pi(u32 __user *uad
static int __fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q,
struct task_struct *argowner)
+ __must_hold(&q->pi_state->pi_mutex.wait_lock)
+ __must_hold(q->lock_ptr)
{
struct futex_pi_state *pi_state = q->pi_state;
struct task_struct *oldowner, *newowner;
@@ -966,6 +971,7 @@ int futex_lock_pi(u32 __user *uaddr, uns
* - EAGAIN: The user space value changed.
*/
futex_q_unlock(hb);
+ __release(q.lock_ptr);
/*
* Handle the case where the owner is in the middle of
* exiting. Wait for the exit to complete otherwise
@@ -1090,6 +1096,7 @@ int futex_lock_pi(u32 __user *uaddr, uns
if (res)
ret = (res < 0) ? res : 0;
+ __release(&hb->lock);
futex_unqueue_pi(&q);
spin_unlock(q.lock_ptr);
if (q.drop_hb_ref) {
@@ -1101,10 +1108,12 @@ int futex_lock_pi(u32 __user *uaddr, uns
out_unlock_put_key:
futex_q_unlock(hb);
+ __release(q.lock_ptr);
goto out;
uaddr_faulted:
futex_q_unlock(hb);
+ __release(q.lock_ptr);
ret = fault_in_user_writeable(uaddr);
if (ret)
--- a/kernel/futex/waitwake.c
+++ b/kernel/futex/waitwake.c
@@ -462,6 +462,7 @@ int futex_wait_multiple_setup(struct fut
}
futex_q_unlock(hb);
+ __release(q->lock_ptr);
}
__set_current_state(TASK_RUNNING);
@@ -628,6 +629,7 @@ int futex_wait_setup(u32 __user *uaddr,
if (ret) {
futex_q_unlock(hb);
+ __release(q->lock_ptr);
ret = get_user(uval, uaddr);
if (ret)
@@ -641,11 +643,13 @@ int futex_wait_setup(u32 __user *uaddr,
if (uval != val) {
futex_q_unlock(hb);
+ __release(q->lock_ptr);
return -EWOULDBLOCK;
}
if (key2 && futex_match(&q->key, key2)) {
futex_q_unlock(hb);
+ __release(q->lock_ptr);
return -EINVAL;
}
Powered by blists - more mailing lists