Skip to content

futex: Resend potentially swallowed owner death notification

Rafael Aquini requested to merge raquini/centos-stream-9:bz2161817 into main

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2161817

This patch is a backport of the following upstream commit:
commit 90d758896787048fa3d4209309d4800f3920e66f
Author: Alexey Izbyshev izbyshev@ispras.ru
Date: Sat Nov 12 00:54:39 2022 +0300

futex: Resend potentially swallowed owner death notification  

Commit ca16d5bee598 ("futex: Prevent robust futex exit race") addressed  
two cases when tasks waiting on a robust non-PI futex remained blocked  
despite the futex not being owned anymore:  

* if the owner died after writing zero to the futex word, but before  
  waking up a waiter  

* if a task waiting on the futex was woken up, but died before updating  
  the futex word (effectively swallowing the notification without acting  
  on it)  

In the second case, the task could be woken up either by the previous  
owner (after the futex word was reset to zero) or by the kernel (after  
the OWNER_DIED bit was set and the TID part of the futex word was reset  
to zero) if the previous owner died without the resetting the futex.  

Because the referenced commit wakes up a potential waiter only if the  
whole futex word is zero, the latter subcase remains unaddressed.  

Fix this by looking only at the TID part of the futex when deciding  
whether a wake up is needed.  

Fixes: ca16d5bee598 ("futex: Prevent robust futex exit race")  
Signed-off-by: Alexey Izbyshev <izbyshev@ispras.ru>  
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>  
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>  
Link: https://lore.kernel.org/r/20221111215439.248185-1-izbyshev@ispras.ru

Signed-off-by: Rafael Aquini aquini@redhat.com

Merge request reports