Merge tag 'locking-urgent-2026-08-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

d4eee3bd · Linus Torvalds <[email protected]> · 2026-08-08 16:39:53 -07:00

Pull futex fix from Ingo Molnar:

 - Fix race in futex_pivot_pending() during private hash resize
   that can cause stuck tasks (Yao Kai)

* tag 'locking-urgent-2026-08-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  futex: Fix race in futex_pivot_pending() during private hash resize

Commit: d4eee3bdb8af1010a0c1edf571c00a7f41c5abe3
Parents: 91a73db6 · 8e7ff730

Merge commit. Changes below are compared with the first parent: 91a73db6.

Changes

1 files changed · +4 −3

File	Status	Add	Del	Content
kernel/futex/core.c	modified	+4	−3	View file

kernel/futex/core.c

View file

diff --git a/kernel/futex/core.c b/kernel/futex/core.c
index 2650d1e..128c575 100644
--- a/kernel/futex/core.c
+++ b/kernel/futex/core.c
@@ -1783,14 +1783,15 @@ void futex_hash_free(struct mm_struct *mm)
 
 static bool futex_pivot_pending(struct mm_struct *mm)
 {
+	struct futex_mm_phash *mmph = &mm->futex.phash;
 	struct futex_private_hash *fph;
 
-	guard(rcu)();
+	guard(mutex)(&mmph->lock);
 
-	if (!mm->futex.phash.hash_new)
+	if (!mmph->hash_new)
 		return true;
 
-	fph = rcu_dereference(mm->futex.phash.hash);
+	fph = rcu_dereference_raw(mmph->hash);
 	return futex_ref_is_dead(fph);
 }
 