Re: [PATCH] futex: Prevent robust futex exit race more

[Thomas Gleixner]

On Wed, Jul 29 2026 at 10:47, Keno Fischer wrote:
> On Wed, 29 Jul 2026 15:47:17 +0200, Thomas Gleixner <tglx@xxxxxxxxxx> wrote:
>> On Tue, Jul 28 2026 at 18:13, Keno Fischer wrote:
>>
>>> On Tue, Jul 28, 2026 at 6:05 PM Thomas Gleixner <tglx@xxxxxxxxxx> wrote:
>>>> Seems your mail client mangled the patch. See:
>>>
>>> Yeah, sorry about that, I've fixed that since. Gmail is a huge pain here.
>>
>> Can you please resend then?
>>
> Of course - resent below. Sorry again for the hassle.

It's slightly less mangled than the original one, which replaced tabs
with spaces in some places, but still fails to apply out of the box.

> --- a/kernel/futex/core.c
> +++ b/kernel/futex/core.c
> @@ -982,8 +982,11 @@ static int handle_futex_death(u32 __user *uaddr,
> struct task_struct *curr,

Forced line break. Still causes:

Applying: futex: Prevent robust futex exit race more
error: corrupt patch at line 10

>  		return -1;
>
>  	/*
> -	 * Special case for regular (non PI) futexes. The unlock path in
> -	 * user space has two race scenarios:
> +	 * Special case for regular (non PI) futexes. Ordinarily, we do
> +	 * not perform any processing here unless the current thread was
> +	 * the owner of the futex (by the TID check below).
> +	 *
> +	 * However, the unlock path has three race scenarios:
>  	 *
>  	 * 1. The unlock path releases the user space futex value and
>  	 *    before it can execute the futex() syscall to wake up
> @@ -992,42 +995,70 @@ static int handle_futex_death(u32 __user *uaddr,
> struct task_struct *curr,

Ditto

>  	 * 2. A woken up waiter is killed before it can acquire the
>  	 *    futex in user space.
>  	 *
>  	 */
>  	owner = uval & FUTEX_TID_MASK;
>

This empty line got the leading space, which is prepended by diff,
stripped off. Some tools tolerate that, some not.

> -	if (pending_op && !pi && !owner) {
> -		futex_wake(uaddr, FLAGS_SIZE_32 | FLAGS_SHARED, NULL, 1,
> -			   FUTEX_BITSET_MATCH_ANY);
> +	if (owner != task_pid_vnr(curr)) {
> +		if (pending_op && !pi &&
> +		    (!owner || !(uval & FUTEX_WAITERS)))
> +			futex_wake(uaddr, FLAGS_SIZE_32 | FLAGS_SHARED, NULL, 1,
> +				   FUTEX_BITSET_MATCH_ANY);
>  		return 0;
>  	}
>

Same here.

> -	if (owner != task_pid_vnr(curr))
> -		return 0;
> -
>  	/*
>  	 * Ok, this dying thread is truly holding a futex
>  	 * of interest. Set the OWNER_DIED bit atomically

Please send the patch to yourself, save the mail and try to apply
it with git am.