Re: [PATCH v5 5/7] futex: Remove the limit of elements for sys_set_robust_list2 lists

On Thu, Jun 26 2025 at 14:11, André Almeida wrote:

Remove the limit of ROBUST_LIST_LIMIT elements that a robust list can have, for the ones created with the new interface. This is done by

With which new interface?

overwritten the list as it's proceeded in a way that we avoid circular

overwriting each processed list entry to point at ...., which eliminates a potential circular list.

lists.

For the old interface, we keep the limited behavior to avoid changing

s/we//

the API.

Which API would be violated?

Overwriting the dying tasks robust list entries is not violating any ABI. The task's memory is on the way to be destroyed.

Signed-off-by: André Almeida andrealmeid@igalia.com

kernel/futex/core.c | 37 +++++++++++++++++++++++++++++-------- 1 file changed, 29 insertions(+), 8 deletions(-)

diff --git a/kernel/futex/core.c b/kernel/futex/core.c index 1049f8ef3ce3c611b3be0ca12df34a98f710121d..942b66facdea16cd7be2235d95c2bbbae8d7cc63 100644 --- a/kernel/futex/core.c +++ b/kernel/futex/core.c @@ -1152,7 +1152,8 @@ static inline int fetch_robust_entry(struct robust_list __user **entry,

• We silently return on any sign of list-walking problem.

*/ static void exit_robust_list64(struct task_struct *curr,

• 	       struct robust_list_head __user *head)
  

• 	       struct robust_list_head __user *head,
  

• 	       bool destroyable)
  

{ struct robust_list __user *entry, *next_entry, *pending; unsigned int limit = ROBUST_LIST_LIMIT, pi, pip; @@ -1196,13 +1197,17 @@ static void exit_robust_list64(struct task_struct *curr, } if (rc) return;

• entry = next_entry;
  

• pi = next_pi;
  

• /*
  • Avoid excessively long or circular lists:
  */

• if (!--limit)
  

• if (!destroyable && !--limit)
  break;
  

• else
  

• 	put_user(&head->list, &entry->next);
  

Unchecked put_user() with zero explanation what it actually does.

• entry = next_entry;
  

• pi = next_pi;
  

cond_resched(); } @@ -1214,7 +1219,8 @@ static void exit_robust_list64(struct task_struct *curr, } #else static void exit_robust_list64(struct task_struct *curr,

• 	       struct robust_list_head __user *head)
  

• 	       struct robust_list_head __user *head,
  

• 	       bool destroyable)
  

{ pr_warn("32bit kernel should not allow ROBUST_LIST_64BIT"); } @@ -1252,7 +1258,8 @@ fetch_robust_entry32(u32 *uentry, struct robust_list __user **entry,

• We silently return on any sign of list-walking problem.

*/ static void exit_robust_list32(struct task_struct *curr,

• 	       struct robust_list_head32 __user *head)
  

• 	       struct robust_list_head32 __user *head,
  

• 	       bool destroyable)
  

{ struct robust_list __user *entry, *next_entry, *pending; unsigned int limit = ROBUST_LIST_LIMIT, pi, pip;

So this get's a destroyable argument as well, but no implementation?

@@ -1474,10 +1481,19 @@ static void exit_pi_state_list(struct task_struct *curr) static inline void exit_pi_state_list(struct task_struct *curr) { } #endif +/*

• • futex_cleanup - After the task exists, process the robust lists
• • Walk through the linked list, parsing robust lists and freeing the
• • allocated lists. Lists created with the set_robust_list2 don't have a limit
• • for sizing and can be destroyed while we walk on it to avoid circular list.
• */

static void futex_cleanup(struct task_struct *tsk) { struct robust_list2_entry *curr, *n; struct list_head *list2 = &tsk->robust_list2;

• bool destroyable = true;
• int i = 0;

/* * Walk through the linked list, parsing robust lists and freeing the @@ -1485,15 +1501,20 @@ static void futex_cleanup(struct task_struct *tsk) */ if (unlikely(!list_empty(list2))) { list_for_each_entry_safe(curr, n, list2, list) {

• 	destroyable = true;
  

• 	if (tsk->robust_list_index == i)
  

• 		destroyable = false;
  

Oh well.....