diff options
| author | Ji'an Zhou <eilaimemedsnaimel@gmail.com> | 2026-06-02 09:12:04 +0000 |
|---|---|---|
| committer | Thomas Gleixner <tglx@kernel.org> | 2026-06-02 22:27:04 +0200 |
| commit | 74e144274af39935b0f410c0ee4d2b91c3730414 (patch) | |
| tree | d342727d2f614c47d7d279c6fab7d754cb3535c2 /kernel | |
| parent | e43ffb69e0438cddd72aaa30898b4dc446f664f8 (diff) | |
futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock
When FUTEX_CMP_REQUEUE_PI requeues a non-top waiter that already owns the
target PI futex, task_blocks_on_rt_mutex() returns -EDEADLK before setting
waiter->task.
The subsequent remove_waiter() in rt_mutex_start_proxy_lock() dereferences
the NULL waiter->task, causing a kernel crash.
Add a self-deadlock check for non-top waiters before calling
rt_mutex_start_proxy_lock(), analogous to the top-waiter check in
futex_lock_pi_atomic().
Fixes: 3bfdc63936dd4773109b7b8c280c0f3b5ae7d349 ("rtmutex: Use waiter::task instead of current in remove_waiter()")
Signed-off-by: Ji'an Zhou <eilaimemedsnaimel@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: stable@vger.kernel.org
Diffstat (limited to 'kernel')
| -rw-r--r-- | kernel/futex/requeue.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/kernel/futex/requeue.c b/kernel/futex/requeue.c index b597cb3d17fc..1d99a84dc9ad 100644 --- a/kernel/futex/requeue.c +++ b/kernel/futex/requeue.c @@ -643,6 +643,12 @@ retry_private: continue; } + /* Self-deadlock: non-top waiter already owns the PI futex. */ + if (rt_mutex_owner(&pi_state->pi_mutex) == this->task) { + ret = -EDEADLK; + break; + } + ret = rt_mutex_start_proxy_lock(&pi_state->pi_mutex, this->rt_waiter, this->task); |