Re: [PATCH] futex: Canonicalize arm64 tagged user addresses

[Catalin Marinas]

On Thu, Oct 22, 2026 at 07:06:02PM -0700, Shubhang Kaushik (Ampere) wrote:
> On arm64, a thread that enables the tagged address ABI can pass valid
> top-byte-tagged user pointers to futex syscalls. Such a pointer must
> have the same syscall behaviour as its untagged form.
> 
> get_futex_key() validates the user address with access_ok(), but uses
> the raw address when constructing private and shared-anonymous futex
> keys. A waiter using a tagged address and a waker using the untagged
> form can therefore access the same futex word while hashing to distinct
> keys, causing FUTEX_WAKE to miss the waiter.
> 
> Keep access_ok() on the original pointer so that arm64 retains its
> per-thread tagged-address ABI enforcement. Canonicalize the address
> afterwards, before it is used for futex key construction and shared
> mapping lookup.
> 
> Add an arm64 64-bit selftest for a tagged private waiter woken through
> the corresponding untagged address.
> 
> Fixes: 63f0c6037965 ("arm64: Introduce prctl() options to control the tagged user addresses ABI")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Shubhang Kaushik (Ampere) <sh@xxxxxxxxxx>

Reviewed-by: Catalin Marinas <catalin.marinas@xxxxxxx>

The patch is fairly generic but I guess at the moment it only affects
arm64 (on x86, access_ok() on tagged pointers still fails).

Thomas, do you have any preference for this patch? Happy for it to go
via tip.

Thanks.

-- 
Catalin