Re: [BUG] futex: scheduling-while-atomic because nested vfork can break guard(private_hash)

[Thomas Gleixner]

On Fri, Sep 11 2026 at 11:04, Peter Zijlstra wrote:

CC: +bigeasy

> On Fri, Sep 11, 2026 at 10:36:39AM +0200, Peter Zijlstra wrote:
>> On Thu, Sep 10, 2026 at 05:27:54PM +0200, Jann Horn wrote:
>
>> > Impact, related issues
>> > ==========
>> > futex_wait_multiple_setup() follows the same pattern of using
>> > guard(private_hash)(current->mm) to ensure that a later CLASS(hbr,
>> > hbr)(&q->key) won't sleep and is probably affected by the same issue.
>> > 
>> > __futex_unlock_pi() and requeue_pi_wake_futex() also use
>> > futex_private_hash(), but there the race seems benign.
>> > 
>> > This issue also means that different futex users could disagree about
>> > the hash bucket that a private futex belongs in (older futex_hash()
>> > calls returning a pointer into the global hash, newer futex_hash()
>> > calls returning a pointer into the private hash).
>> 
>> Right, that transition is not supposed to be possible. Notably a single
>> thread cannot have (private) futex waiters, and we allocate the private
>> hash on cloning the second thread.
>> 
>> > Sidenote
>> > ========
>> > Maybe we should block CLONE_VFORK when current->vfork_done!=NULL ? It
>> > is clearly bad to allow nested vfork() such that a SIGKILL can cause
>> > two threads to run concurrently on the same userspace stack.
>> > 
>> > But I'm not sure if that's a good fix for these futex issues - a fix
>> > that doesn't rely on such distant assumptions might be nicer...
>> 
>> So need_futex_hash_allocate_default() is explicitly excluding vfork from
>> causing a private hash to be allocated. Perhaps we should fix that.
>> 
>> I need more thinking (and wake-up juice) to see if that might perhaps
>> bring other problems with it.
>
> So I can confirm that the below does in fact cure your testcase.
>
> Per commit: ee9dce44362b ("futex: Drop CLONE_THREAD requirement for private default hash alloc")
> the reason for excluding vfork() was performance and thinking this
> would/could not matter, which you've proven to be clearly false.
>
> Thomas?

I don't remember why we excluded VFORK in the first place. Sebastian?

> ---
>  kernel/fork.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/kernel/fork.c b/kernel/fork.c
> index 416758c8a3d4..bc32ea19099e 100644
> --- a/kernel/fork.c
> +++ b/kernel/fork.c
> @@ -1996,9 +1996,9 @@ static bool need_futex_hash_allocate_default(u64 clone_flags)
>  {
>  	/*
>  	 * Allocate a default futex hash for any sibling that will
> -	 * share the parent's mm, except vfork.
> +	 * share the parent's mm.
>  	 */
> -	return (clone_flags & (CLONE_VM | CLONE_VFORK)) == CLONE_VM;
> +	return clone_flags & CLONE_VM;
>  }
>  
>  /*