Skip to content

Commit 39def6d

Browse files
Sebastian Andrzej SiewiorThomas Gleixner
authored andcommitted
futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock""
The commit cited below should not have been merged. It attemted to fix an existing problem ansd thereby introduced new problems by keeping the pi_state in state Q_REQUEUE_PI_IN_PROGRESS and leaking it. Based on the commit description the intention was to handle the case when task_blocks_on_rt_mutex() returns -EDEADLK and the following remove_waiter() dereferences the NULL pointer in waiter->task. That is already handled by Davidlohr in commit 40a25d5 ("locking/rtmutex: Skip remove_waiter() when waiter is not enqueued") and requires no further acting. Revert the commit breaking the "waiter == owner" case again. Fixes: 74e1442 ("futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock") Reported-by: Michael Bommarito <michael.bommarito@gmail.com> Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260701131150.0Ijhq4Dw@linutronix.de Closes: https://lore.kernel.org/all/20260629020049.2082397-1-michael.bommarito@gmail.com
1 parent dc59e4f commit 39def6d

1 file changed

Lines changed: 0 additions & 6 deletions

File tree

kernel/futex/requeue.c

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -645,12 +645,6 @@ int futex_requeue(u32 __user *uaddr1, unsigned int flags1,
645645
continue;
646646
}
647647

648-
/* Self-deadlock: non-top waiter already owns the PI futex. */
649-
if (rt_mutex_owner(&pi_state->pi_mutex) == this->task) {
650-
ret = -EDEADLK;
651-
break;
652-
}
653-
654648
ret = rt_mutex_start_proxy_lock(&pi_state->pi_mutex,
655649
this->rt_waiter,
656650
this->task);

0 commit comments

Comments
 (0)