github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-28 01:55:51 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

Misc locking fixes:

Browse Source 
- Fix a NULL pointer dereference bug in the FUTEX_CMP_REQUEUE_PI
    code (Ji'an Zhou)
 
  - Fix a NULL pointer dereference bug in the rtmutex code
    (Davidlohr Bueso)
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmok97sRHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1hq8A//YmVZmkJVV/5AFYZTJEHQmTpHYR4oyIKE
 7u0glsuWfgO+m70RQLQK6FHFC8LRUVmn692fbTrXRb3sEmQvZwpvLjy0JfM2HgFm
 Sv/1C0KKGQOE6UVcMIaiJIr+/uNXz6iC1zlln5rbdJOWfQdobNENTC1QDnzUPsWp
 810up6kwkG/fgivaemsL29JH7HM5y7dWg8x9RmRmzRMsAVuX2NNeZWr3UVSB1ThA
 n9DGR7rhZa2MSb0lDgmzEPn1mn3/8wvMDEaore9qAgXqwQ6wIxKc+9YQoi/CcpH3
 Ar7/gsDXpgy1CS5qtwYBajFgwEhqLwtrN90bR4nW7CKFrFxRLZz/G7kS/iV2vjWd
 CtlBYMINTNhXA2omuIaTSykt76Y44iV9tul/+m7XCTDocl2gKU/SYSn6+MoEnW+G
 Nu3m8clJHQc5SavDJJL/LvIceemeiBUvOwRHYS6jrNcnaUbdwqXrRDYJNYVTIpYX
 bdI3moWI25q8nC+rOSXDO9FxY+znJ5ZOEvd/j2W8nl2d7Io+NcJdC6Ec/vKsjIzq
 3dORTAevrrqNi37VVRum2ht4QnFXRverFGrpLmgGHbufsBeFCQ7p4n6ovj2AjIg2
 jpzwGrkDNZKnjFQrUi5vh70bKkrDlijLGvPGvTfu/7Ah7EYFqTLzNszor8B3XIkd
 7eIAsWVGbIk=
 =a6/Z
 -----END PGP SIGNATURE-----

Merge tag 'locking-urgent-2026-06-07' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull locking fixes from Ingo Molnar:

 - Fix a NULL pointer dereference bug in the FUTEX_CMP_REQUEUE_PI
   code (Ji'an Zhou)

 - Fix a NULL pointer dereference bug in the rtmutex code (Davidlohr
   Bueso)

* tag 'locking-urgent-2026-06-07' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  locking/rtmutex: Skip remove_waiter() when waiter is not enqueued
  futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock
This commit is contained in:
Linus Torvalds 2026-06-07 12:43:21 -07:00
commit 96c1ddbc16
3 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
kernel/futex/requeue.c
View File

@ -643,6 +643,12 @@ int futex_requeue(u32 __user *uaddr1, unsigned int flags1,
continue;
}
/* Self-deadlock: non-top waiter already owns the PI futex. */
if (rt_mutex_owner(&pi_state->pi_mutex) == this->task) {
ret = -EDEADLK;
break;
}
ret = rt_mutex_start_proxy_lock(&pi_state->pi_mutex,
this->rt_waiter,
this->task);

3
kernel/locking/rtmutex.c
View File

@ -1558,6 +1558,9 @@ static void __sched remove_waiter(struct rt_mutex_base *lock,
lockdep_assert_held(&lock->wait_lock);
if (!waiter_task) /* never enqueued */
return;
scoped_guard(raw_spinlock, &waiter_task->pi_lock) {
rt_mutex_dequeue(lock, waiter);
waiter_task->pi_blocked_on = NULL;

2
kernel/locking/rtmutex_api.c
View File

@ -365,7 +365,7 @@ int __sched rt_mutex_start_proxy_lock(struct rt_mutex_base *lock,
raw_spin_lock_irq(&lock->wait_lock);
ret = __rt_mutex_start_proxy_lock(lock, waiter, task, &wake_q);
if (unlikely(ret))
if (unlikely(ret < 0))
remove_waiter(lock, waiter);
preempt_disable();
raw_spin_unlock_irq(&lock->wait_lock);