diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2026-05-03 08:17:09 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2026-05-03 08:17:09 -0700 |
| commit | cffcf520fd69fe5a93b519cf0c7ccc5e467fcb1c (patch) | |
| tree | fcc437f9666cd2d2abe107ec59f88192746f79da /kernel | |
| parent | c3cba36b394ba48b7920dcb99c46cee8ee59a116 (diff) | |
| parent | bc7304f3ae20972d11db6e0b1b541c63feda5f05 (diff) | |
| download | linux-cffcf520fd69fe5a93b519cf0c7ccc5e467fcb1c.tar.gz linux-cffcf520fd69fe5a93b519cf0c7ccc5e467fcb1c.zip | |
Merge tag 'locking-urgent-2026-05-03' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull locking fix from Ingo Molnar:
"Fix lockup in requeue-PI during signal/timeout wakeups, by Sebastian
Andrzej Siewior"
* tag 'locking-urgent-2026-05-03' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
futex: Prevent lockup in requeue-PI during signal/ timeout wakeup
Diffstat (limited to 'kernel')
| -rw-r--r-- | kernel/futex/requeue.c | 13 |
1 files changed, 9 insertions, 4 deletions
diff --git a/kernel/futex/requeue.c b/kernel/futex/requeue.c index d818b4d47f1b..b597cb3d17fc 100644 --- a/kernel/futex/requeue.c +++ b/kernel/futex/requeue.c @@ -319,8 +319,11 @@ futex_proxy_trylock_atomic(u32 __user *pifutex, struct futex_hash_bucket *hb1, return -EINVAL; /* Ensure that this does not race against an early wakeup */ - if (!futex_requeue_pi_prepare(top_waiter, NULL)) + if (!futex_requeue_pi_prepare(top_waiter, NULL)) { + plist_del(&top_waiter->list, &hb1->chain); + futex_hb_waiters_dec(hb1); return -EAGAIN; + } /* * Try to take the lock for top_waiter and set the FUTEX_WAITERS bit @@ -722,10 +725,12 @@ int handle_early_requeue_pi_wakeup(struct futex_hash_bucket *hb, /* * We were woken prior to requeue by a timeout or a signal. - * Unqueue the futex_q and determine which it was. + * Conditionally unqueue the futex_q and determine which it was. */ - plist_del(&q->list, &hb->chain); - futex_hb_waiters_dec(hb); + if (!plist_node_empty(&q->list)) { + plist_del(&q->list, &hb->chain); + futex_hb_waiters_dec(hb); + } /* Handle spurious wakeups gracefully */ ret = -EWOULDBLOCK; |