Re: [PATCH v2] futex: Canonicalize arm64 tagged user addresses

[Catalin Marinas]

On Fri, Oct 30, 2026 at 03:39:59PM -0700, Shubhang Kaushik (Ampere) wrote:
> On arm64, a thread that enables the tagged address ABI can pass valid
> top-byte-tagged user pointers to futex syscalls. Such a pointer must
> have the same syscall behaviour as its untagged form.
> 
> get_futex_key() validates the user address with access_ok(), but uses
> the raw address when constructing private and shared-anonymous futex
> keys. A waiter using a tagged address and a waker using the untagged
> form can therefore access the same futex word while hashing to distinct
> keys, causing FUTEX_WAKE to miss the waiter.
> 
> Keep access_ok() on the original pointer so that arm64 retains its
> per-thread tagged-address ABI enforcement. Canonicalize the address
> afterwards, before it is used for futex key construction and shared
> mapping lookup.
> 
> Add an arm64 64-bit selftest for a tagged private waiter woken through
> the corresponding untagged address.
> 
> Fixes: 63f0c6037965 ("arm64: Introduce prctl() options to control the tagged user addresses ABI")
> Cc: stable@xxxxxxxxxxxxxxx
> Reviewed-by: Catalin Marinas <catalin.marinas@xxxxxxx>
> Signed-off-by: Shubhang Kaushik (Ampere) <sh@xxxxxxxxxx>
> ---
> Changes in v2:
> - Add the generated tagged-address test binary to .gitignore.
> - Compile the arm64-specific test implementation only for arm64 64-bit
>   builds.
> - Avoid relying on /proc/<tid>/wchan to detect that the waiter has
>   queued; retry the untagged wake for a bounded interval instead.
> 
> Link to v1: https://lore.kernel.org/r/20261022-futex-arm64-tagged-uaddr-v1-1-84d8afbe7668@xxxxxxxxxx
> ---
>  kernel/futex/core.c                                |  2 +
>  .../testing/selftests/futex/functional/.gitignore  |  1 +
>  tools/testing/selftests/futex/functional/Makefile  |  1 +
>  .../selftests/futex/functional/futex_tagged_addr.c | 61 ++++++++++++++++++++++
>  tools/testing/selftests/futex/functional/run.sh    |  3 ++
>  5 files changed, 68 insertions(+)

Since this is a cc stable, I'd separate the actual fix from the
kselftest with the latter not cc'ed to stable.

Thanks.

-- 
Catalin