Re: [PATCH 2/2] futex/requeue: Prevent rcuwait use-after-free during requeue PI

[Sebastian Andrzej Siewior]

On 2026-07-21 10:19:57 [+0800], Yao Kai wrote:
> > 
> > You will miss to wake T1 if T2 skips the wake, as suggested. Or do I
> > miss something?
> > 
> 
>    T1                                         T2
>  futex_requeue_pi_wakeup_sync()
>     old = Q_REQUEUE_PI_IN_PROGRESS
>     new = Q_REQUEUE_PI_WAIT
>     cmpxchg()
>                                              requeue_pi_wake_futex()
>                                                task = READ_ONCE(q->task)
>                                                  futex_requeue_pi_complete()
>                                                    old = Q_REQUEUE_PI_WAIT
>                                                    new = Q_REQUEUE_PI_LOCKED
>                                                    cmpxchg()
>     if (old == Q_REQUEUE_PI_IN_PROGRESS)
>      rcuwait_wait_event()
>                                                    rcuwait_wake_up(&q->requeue_wait);
>                                                wake_up_state(task, TASK_NORMAL)
>     <leave>
> 
> Only requeue_pi_wake_futex() can publish Q_REQUEUE_PI_LOCKED. After it calls
> futex_requeue_pi_complete(), it will call wake_up_state(task, TASK_NORMAL)
> to wake up T1 sleeping on rcuwait_wait_event().

That one is intended for the futex_do_wait() but it seems that the outer
wake_up_state() would save the day.
It would deserve a comment and explanation at the least.

> Yao

Sebastian