Ji'an Zhou 74e144274a futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock ... When FUTEX_CMP_REQUEUE_PI requeues a non-top waiter that already owns the target PI futex, task_blocks_on_rt_mutex() returns -EDEADLK before setting waiter->task. The subsequent remove_waiter() in rt_mutex_start_proxy_lock() dereferences the NULL waiter->task, causing a kernel crash. Add a self-deadlock check for non-top waiters before calling rt_mutex_start_proxy_lock(), analogous to the top-waiter check in futex_lock_pi_atomic(). Fixes: 3bfdc63936 ("rtmutex: Use waiter::task instead of current in remove_waiter()") Signed-off-by: Ji'an Zhou <eilaimemedsnaimel@gmail.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Cc: stable@vger.kernel.org		2026-06-02 22:27:04 +02:00
..
core.c	Locking updates for v7.1:	2026-04-14 12:36:25 -07:00
futex.h	futex: Convert to compiler context analysis	2026-03-16 13:16:48 +01:00
Makefile	futex: Convert to compiler context analysis	2026-03-16 13:16:48 +01:00
pi.c	Locking updates for v7.1:	2026-04-14 12:36:25 -07:00
requeue.c	futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock	2026-06-02 22:27:04 +02:00
syscalls.c	futex: Require sys_futex_requeue() to have identical flags	2026-03-26 16:13:48 +01:00
waitwake.c	futex: Convert to compiler context analysis	2026-03-16 13:16:48 +01:00