[PATCH] futex: fix hb lock mismatch in futex_wait_requeue_pi() and CLONE_VFORK hash init

[Hui Peng]

Fix two issues in futex and fork initialization:

1. In futex_wait_requeue_pi(), if futex_wait_queue() returns with
   q.lock_ptr updated tohb2's lock after a requeue timeout or signal
   race, unlocking the original hb1 lock instead of q.lock_ptr leaves
   hb2 locked and unlocks an unheld spinlock. Always unlock via
   q.lock_ptr.
2. In copy_mm() (kernel/fork.c), initialize mm->futex_phash properly
   when cloning so private futex hash state is consistent across
   CLONE_VFORK.

Fixes: e5c6828493b5 ("futex: Split out requeue")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@xxxxxxxxx>
---
diff --git a/kernel/fork.c b/kernel/fork.c
index a5934a317634..8f320f51cae8 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1996,9 +1996,9 @@ static bool need_futex_hash_allocate_default(u64 clone_flags)
 {
 	/*
 	 * Allocate a default futex hash for any sibling that will
-	 * share the parent's mm, except vfork.
+	 * share the parent's mm.
 	 */
-	return (clone_flags & (CLONE_VM | CLONE_VFORK)) == CLONE_VM;
+	return (clone_flags & CLONE_VM) != 0;
 }
 
 /*
diff --git a/kernel/futex/requeue.c b/kernel/futex/requeue.c
index b3f4a4bccb12..72b954d625c4 100644
--- a/kernel/futex/requeue.c
+++ b/kernel/futex/requeue.c
@@ -842,12 +842,13 @@ int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
 	switch (futex_requeue_pi_wakeup_sync(&q)) {
 	case Q_REQUEUE_PI_IGNORE:
 		{
-			CLASS(hbr, hbr)(&q.key);
-			auto hb = hbr.hb;
+			struct futex_hash_bucket *hb;
+
 			/* The waiter is still on uaddr1 */
-			spin_lock(&hb->lock);
+			futex_q_lockptr_lock(&q);
+			hb = container_of(q.lock_ptr, struct futex_hash_bucket, lock);
 			ret = handle_early_requeue_pi_wakeup(hb, &q, to);
-			spin_unlock(&hb->lock);
+			spin_unlock(q.lock_ptr);
 		}
 		break;