linux-stable/kernel/futex
Alexey Izbyshev 1438d6e9d6 futex: Resend potentially swallowed owner death notification
[ Upstream commit 90d7588967 ]

Commit ca16d5bee5 ("futex: Prevent robust futex exit race") addressed
two cases when tasks waiting on a robust non-PI futex remained blocked
despite the futex not being owned anymore:

* if the owner died after writing zero to the futex word, but before
  waking up a waiter

* if a task waiting on the futex was woken up, but died before updating
  the futex word (effectively swallowing the notification without acting
  on it)

In the second case, the task could be woken up either by the previous
owner (after the futex word was reset to zero) or by the kernel (after
the OWNER_DIED bit was set and the TID part of the futex word was reset
to zero) if the previous owner died without the resetting the futex.

Because the referenced commit wakes up a potential waiter only if the
whole futex word is zero, the latter subcase remains unaddressed.

Fix this by looking only at the TID part of the futex when deciding
whether a wake up is needed.

Fixes: ca16d5bee5 ("futex: Prevent robust futex exit race")
Signed-off-by: Alexey Izbyshev <izbyshev@ispras.ru>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lore.kernel.org/r/20221111215439.248185-1-izbyshev@ispras.ru
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-12-31 13:25:45 +01:00
..
core.c futex: Resend potentially swallowed owner death notification 2022-12-31 13:25:45 +01:00
futex.h futex: add missing rtmutex.h include 2022-04-07 15:09:12 +02:00
Makefile futex: Split out wait/wake 2021-10-07 13:51:11 +02:00
pi.c futex: Remove a PREEMPT_RT_FULL reference. 2022-05-13 12:36:51 +02:00
requeue.c futex: Split out requeue 2021-10-07 13:51:10 +02:00
syscalls.c futex: Remove futex_cmpxchg detection 2021-11-25 00:02:28 +01:00
waitwake.c futex: Implement sys_futex_waitv() 2021-10-07 13:51:11 +02:00