futex: Pass in task to futex_queue()

[ Upstream commit 5e0e02f0d7e52cfc8b1adfc778dd02181d8b47b4 ]

futex_queue() -> __futex_queue() uses 'current' as the task to store in
the struct futex_q->task field. This is fine for synchronous usage of
the futex infrastructure, but it's not always correct when used by
io_uring where the task doing the initial futex_queue() might not be
available later on. This doesn't lead to any issues currently, as the
io_uring side doesn't support PI futexes, but it does leave a
potentially dangling pointer which is never a good idea.

Have futex_queue() take a task_struct argument, and have the regular
callers pass in 'current' for that. Meanwhile io_uring can just pass in
NULL, as the task should never be used off that path. In theory
req->tctx->task could be used here, but there's no point populating it
with a task field that will never be used anyway.

Reported-by: Jann Horn <jannh@google.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/all/22484a23-542c-4003-b721-400688a0d055@kernel.dk
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/io_uring/futex.c b/io_uring/futex.c
index 914848f46beb21345f0913c1399a896bb5884dca..01f044f89f8fa96c5595c4903e176a171f45bad0 100644 (file)
--- a/io_uring/futex.c
+++ b/io_uring/futex.c
@@ -349,7 +349,7 @@ int io_futex_wait(struct io_kiocb *req, unsigned int issue_flags)
                hlist_add_head(&req->hash_node, &ctx->futex_list);
                io_ring_submit_unlock(ctx, issue_flags);
 
-               futex_queue(&ifd->q, hb);
+               futex_queue(&ifd->q, hb, NULL);
                return IOU_ISSUE_SKIP_COMPLETE;
        }
 

diff --git a/kernel/futex/core.c b/kernel/futex/core.c
index 136768ae26375fafcebf8815ae965f13a3161adf..010607a9919498661dd60f17fc0f10afc11cad08 100644 (file)
--- a/kernel/futex/core.c
+++ b/kernel/futex/core.c
@@ -554,7 +554,8 @@ void futex_q_unlock(struct futex_hash_bucket *hb)
        futex_hb_waiters_dec(hb);
 }
 
-void __futex_queue(struct futex_q *q, struct futex_hash_bucket *hb)
+void __futex_queue(struct futex_q *q, struct futex_hash_bucket *hb,
+                  struct task_struct *task)
 {
        int prio;
 
@@ -570,7 +571,7 @@ void __futex_queue(struct futex_q *q, struct futex_hash_bucket *hb)
 
        plist_node_init(&q->list, prio);
        plist_add(&q->list, &hb->chain);
-       q->task = current;
+       q->task = task;
 }
 
 /**

diff --git a/kernel/futex/futex.h b/kernel/futex/futex.h
index 8b195d06f4e8edcb6ebc84925e2ddc25334e51a7..12e47386232ed6ca665d9612f186d910d941ab82 100644 (file)
--- a/kernel/futex/futex.h
+++ b/kernel/futex/futex.h
@@ -230,13 +230,15 @@ extern int futex_get_value_locked(u32 *dest, u32 __user *from);
 extern struct futex_q *futex_top_waiter(struct futex_hash_bucket *hb, union futex_key *key);
 
 extern void __futex_unqueue(struct futex_q *q);
-extern void __futex_queue(struct futex_q *q, struct futex_hash_bucket *hb);
+extern void __futex_queue(struct futex_q *q, struct futex_hash_bucket *hb,
+                               struct task_struct *task);
 extern int futex_unqueue(struct futex_q *q);
 
 /**
  * futex_queue() - Enqueue the futex_q on the futex_hash_bucket
  * @q: The futex_q to enqueue
  * @hb:        The destination hash bucket
+ * @task: Task queueing this futex
  *
  * The hb->lock must be held by the caller, and is released here. A call to
  * futex_queue() is typically paired with exactly one call to futex_unqueue().  The
@@ -244,11 +246,14 @@ extern int futex_unqueue(struct futex_q *q);
  * or nothing if the unqueue is done as part of the wake process and the unqueue
  * state is implicit in the state of woken task (see futex_wait_requeue_pi() for
  * an example).
+ *
+ * Note that @task may be NULL, for async usage of futexes.
  */
-static inline void futex_queue(struct futex_q *q, struct futex_hash_bucket *hb)
+static inline void futex_queue(struct futex_q *q, struct futex_hash_bucket *hb,
+                              struct task_struct *task)
        __releases(&hb->lock)
 {
-       __futex_queue(q, hb);
+       __futex_queue(q, hb, task);
        spin_unlock(&hb->lock);
 }
 

diff --git a/kernel/futex/pi.c b/kernel/futex/pi.c
index 5722467f273794ec314870fc76d0ba04a8617f7e..8ec12f1aff83bea3c0023b56104e195c8fd04632 100644 (file)
--- a/kernel/futex/pi.c
+++ b/kernel/futex/pi.c
@@ -981,7 +981,7 @@ retry_private:
        /*
         * Only actually queue now that the atomic ops are done:
         */
-       __futex_queue(&q, hb);
+       __futex_queue(&q, hb, current);
 
        if (trylock) {
                ret = rt_mutex_futex_trylock(&q.pi_state->pi_mutex);

diff --git a/kernel/futex/waitwake.c b/kernel/futex/waitwake.c
index 3a10375d952186520c3583f43caef23a3a7a3041..a9056acb75eef94f1a0bc1531df095ab8f5b07a0 100644 (file)
--- a/kernel/futex/waitwake.c
+++ b/kernel/futex/waitwake.c
@@ -350,7 +350,7 @@ void futex_wait_queue(struct futex_hash_bucket *hb, struct futex_q *q,
         * access to the hash list and forcing another memory barrier.
         */
        set_current_state(TASK_INTERRUPTIBLE|TASK_FREEZABLE);
-       futex_queue(q, hb);
+       futex_queue(q, hb, current);
 
        /* Arm the timer */
        if (timeout)
@@ -461,7 +461,7 @@ retry:
                         * next futex. Queue each futex at this moment so hb can
                         * be unlocked.
                         */
-                       futex_queue(q, hb);
+                       futex_queue(q, hb, current);
                        continue;
                }