diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2026-06-07 12:43:21 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2026-06-07 12:43:21 -0700 |
| commit | 96c1ddbc16f4dd15d6d359ce55ba29e8cd80dc46 (patch) | |
| tree | deae7dc76a2594b5db83ef74070218cb78bff9a7 /kernel/futex/requeue.c | |
| parent | e2264c52e18bd54a4f762c393e341cb27fd5e5cd (diff) | |
| parent | 40a25d59e85b3c8709ac2424d44f65610467871e (diff) | |
Merge tag 'locking-urgent-2026-06-07' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull locking fixes from Ingo Molnar:
- Fix a NULL pointer dereference bug in the FUTEX_CMP_REQUEUE_PI
code (Ji'an Zhou)
- Fix a NULL pointer dereference bug in the rtmutex code (Davidlohr
Bueso)
* tag 'locking-urgent-2026-06-07' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
locking/rtmutex: Skip remove_waiter() when waiter is not enqueued
futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock
Diffstat (limited to 'kernel/futex/requeue.c')
| -rw-r--r-- | kernel/futex/requeue.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/kernel/futex/requeue.c b/kernel/futex/requeue.c index b597cb3d17fc..1d99a84dc9ad 100644 --- a/kernel/futex/requeue.c +++ b/kernel/futex/requeue.c @@ -643,6 +643,12 @@ retry_private: continue; } + /* Self-deadlock: non-top waiter already owns the PI futex. */ + if (rt_mutex_owner(&pi_state->pi_mutex) == this->task) { + ret = -EDEADLK; + break; + } + ret = rt_mutex_start_proxy_lock(&pi_state->pi_mutex, this->rt_waiter, this->task); |