Catcrafts/milos-linux
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
milos-linux/kernel/futex
History
Exact
Ji'an Zhou 74e144274a futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock 
When FUTEX_CMP_REQUEUE_PI requeues a non-top waiter that already owns the
target PI futex, task_blocks_on_rt_mutex() returns -EDEADLK before setting
waiter->task.

The subsequent remove_waiter() in rt_mutex_start_proxy_lock() dereferences
the NULL waiter->task, causing a kernel crash.

Add a self-deadlock check for non-top waiters before calling
rt_mutex_start_proxy_lock(), analogous to the top-waiter check in
futex_lock_pi_atomic().

Fixes: 3bfdc63936 ("rtmutex: Use waiter::task instead of current in remove_waiter()")
Signed-off-by: Ji'an Zhou <eilaimemedsnaimel@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: stable@vger.kernel.org
2026-06-02 22:27:04 +02:00
..
core.c Locking updates for v7.1: 2026-04-14 12:36:25 -07:00
futex.h futex: Convert to compiler context analysis 2026-03-16 13:16:48 +01:00
Makefile futex: Convert to compiler context analysis 2026-03-16 13:16:48 +01:00
pi.c Locking updates for v7.1: 2026-04-14 12:36:25 -07:00
requeue.c futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock 2026-06-02 22:27:04 +02:00
syscalls.c futex: Require sys_futex_requeue() to have identical flags 2026-03-26 16:13:48 +01:00
waitwake.c futex: Convert to compiler context analysis 2026-03-16 13:16:48 +01:00