[PATCH 0/2] futex/requeue: Fix requeue PI races

[Yao Kai]

Hi,

This series fixes two independent issues in the requeue PI wait path.
They are grouped because both affect the handoff between the futex
requeue state machine and the target PI rtmutex.

Patch 1 restores rtmutex scheduling preparation when a waiter is moved to
the target PI futex before futex_do_wait() can schedule. It splits block
plug flushing from worker notification so that each operation runs at a
safe point.

Patch 2 prevents the requeue side from accessing the waiter's stack-based
futex_q after publishing Q_REQUEUE_PI_LOCKED. The waiter is instead woken
through the task pointer saved before publishing completion.

Both patches carry Fixes tags and are marked for stable backporting.

Build testing:

  - arm64 defconfig with W=1
  - arm64 PREEMPT_RT with KASAN_GENERIC, PROVE_LOCKING,
    DEBUG_RT_MUTEXES, and W=1
  - kernel/futex/requeue.o and kernel/sched/core.o built successfully
  - all patches pass checkpatch.pl --strict

Runtime testing:

  - Patch 1: the original rt_mutex_schedule() warning reproducer no longer
    triggers the warning
  - Patch 2: the original PREEMPT_RT KASAN reproducer no longer reports an
    invalid access
  - The futex requeue PI selftests and stress tests pass

Yao Kai (2):
  futex/requeue: Fix rtmutex schedule preparation for requeue PI
  futex/requeue: Prevent rcuwait use-after-free during requeue PI

 include/linux/sched/rt.h |  2 ++
 kernel/futex/requeue.c   | 24 ++++++++++++++++++---
 kernel/sched/core.c      | 45 +++++++++++++++++++++++++++++++++-------
 3 files changed, 60 insertions(+), 11 deletions(-)

-- 
2.43.0