futex: Ensure get_futex_key_refs() always implies a barrier
futex: Ensure get_futex_key_refs() always implies a barrier

Commit b0c29f79ecea (futexes: Avoid taking the hb->lock if there's
nothing to wake up) changes the futex code to avoid taking a lock when
there are no waiters. This code has been subsequently fixed in commit
11d4616bd07f (futex: revert back to the explicit waiter counting code).
Both the original commit and the fix-up rely on get_futex_key_refs() to
always imply a barrier.

However, for private futexes, none of the cases in the switch statement
of get_futex_key_refs() would be hit and the function completes without
a memory barrier as required before checking the "waiters" in
futex_wake() -> hb_waiters_pending(). The consequence is a race with a
thread waiting on a futex on another CPU, allowing the waker thread to
read "waiters == 0" while the waiter thread to have read "futex_val ==
locked" (in kernel).

Without this fix, the problem (user space deadlocks) can be seen with
Android bionic's mutex implementation on an arm64 multi-cluster system.

Signed-off-by: Catalin Marinas <15ce75b290ebaf27c3f9fd73ab848685ed3d8261@arm.com>
Reported-by: Matteo Franchin <df7fafb4ad459858c7c8472be69ac987bf580e65@arm.com>
Fixes: b0c29f79ecea (futexes: Avoid taking the hb->lock if there's nothing to wake up)
Acked-by: Davidlohr Bueso <bfcdf3e6ca6cef45543bfbb57509c92aec9a39fb@stgolabs.net>
Tested-by: Mike Galbraith <d1e2fad1f6337a0a3a08db0a5375a8a96150db4c@gmail.com>
Cc: <4fbacc2fa0ffdbb11bf1ad6925b886ebd08dd15f@vger.kernel.org>
Cc: Darren Hart <38f9eaa30910c40b06f5a60020b1222f2a953801@linux.intel.com>
Cc: Thomas Gleixner <00e4cf8f46a57000a44449bf9dd8cbbcc209fd2a@linutronix.de>
Cc: Peter Zijlstra <3fddac958924aef220f202ca567388ddab3f14a8@infradead.org>
Cc: Ingo Molnar <9dbbbf0688fedc85ad4da37637f1a64b8c718ee2@kernel.org>
Cc: Paul E. McKenney <1e0ce936bb9b355d257bf5790d2513c3f28be22b@linux.vnet.ibm.com>
Signed-off-by: Linus Torvalds <69652caca27c8b940640ad396ab71f93cacec34f@linux-foundation.org>

KristFoundation/Programs,KristFoundation/Programs,KristFoundation/Programs,KristFoundation/Programs,KristFoundation/Programs,KristFoundation/Programs