Re: [BUG] futex: scheduling-while-atomic because nested vfork can break guard(private_hash)

[Peter Zijlstra]

On Fri, Sep 11, 2026 at 10:36:39AM +0200, Peter Zijlstra wrote:
> On Thu, Sep 10, 2026 at 05:27:54PM +0200, Jann Horn wrote:

> > Impact, related issues
> > ==========
> > futex_wait_multiple_setup() follows the same pattern of using
> > guard(private_hash)(current->mm) to ensure that a later CLASS(hbr,
> > hbr)(&q->key) won't sleep and is probably affected by the same issue.
> > 
> > __futex_unlock_pi() and requeue_pi_wake_futex() also use
> > futex_private_hash(), but there the race seems benign.
> > 
> > This issue also means that different futex users could disagree about
> > the hash bucket that a private futex belongs in (older futex_hash()
> > calls returning a pointer into the global hash, newer futex_hash()
> > calls returning a pointer into the private hash).
> 
> Right, that transition is not supposed to be possible. Notably a single
> thread cannot have (private) futex waiters, and we allocate the private
> hash on cloning the second thread.
> 
> > Sidenote
> > ========
> > Maybe we should block CLONE_VFORK when current->vfork_done!=NULL ? It
> > is clearly bad to allow nested vfork() such that a SIGKILL can cause
> > two threads to run concurrently on the same userspace stack.
> > 
> > But I'm not sure if that's a good fix for these futex issues - a fix
> > that doesn't rely on such distant assumptions might be nicer...
> 
> So need_futex_hash_allocate_default() is explicitly excluding vfork from
> causing a private hash to be allocated. Perhaps we should fix that.
> 
> I need more thinking (and wake-up juice) to see if that might perhaps
> bring other problems with it.

So I can confirm that the below does in fact cure your testcase.

Per commit: ee9dce44362b ("futex: Drop CLONE_THREAD requirement for private default hash alloc")
the reason for excluding vfork() was performance and thinking this
would/could not matter, which you've proven to be clearly false.

Thomas?


---
 kernel/fork.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/kernel/fork.c b/kernel/fork.c
index 416758c8a3d4..bc32ea19099e 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1996,9 +1996,9 @@ static bool need_futex_hash_allocate_default(u64 clone_flags)
 {
 	/*
 	 * Allocate a default futex hash for any sibling that will
-	 * share the parent's mm, except vfork.
+	 * share the parent's mm.
 	 */
-	return (clone_flags & (CLONE_VM | CLONE_VFORK)) == CLONE_VM;
+	return clone_flags & CLONE_VM;
 }
 
 /*