6.18-stable patches

added patches:
	futex-requeue-revert-prevent-null-pointer-dereference-in-remove_waiter-on-self-deadlock.patch

diff --git a/queue-6.18/futex-requeue-revert-prevent-null-pointer-dereference-in-remove_waiter-on-self-deadlock.patch b/queue-6.18/futex-requeue-revert-prevent-null-pointer-dereference-in-remove_waiter-on-self-deadlock.patch
new file mode 100644 (file)
index 0000000..d49d2c3
--- /dev/null
+++ b/queue-6.18/futex-requeue-revert-prevent-null-pointer-dereference-in-remove_waiter-on-self-deadlock.patch
@@ -0,0 +1,50 @@
+From 39def6d250d370298f86c116f4ac60093cefadaa Mon Sep 17 00:00:00 2001
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Date: Wed, 1 Jul 2026 15:11:50 +0200
+Subject: futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock""
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+commit 39def6d250d370298f86c116f4ac60093cefadaa upstream.
+
+The commit cited below should not have been merged. It attemted to fix an
+existing problem ansd thereby introduced new problems by keeping the
+pi_state in state Q_REQUEUE_PI_IN_PROGRESS and leaking it.
+
+Based on the commit description the intention was to handle the case
+when task_blocks_on_rt_mutex() returns -EDEADLK and the following
+remove_waiter() dereferences the NULL pointer in waiter->task.
+
+That is already handled by Davidlohr in commit 40a25d59e85b3
+("locking/rtmutex: Skip remove_waiter() when waiter is not enqueued") and
+requires no further acting.
+
+Revert the commit breaking the "waiter == owner" case again.
+
+Fixes: 74e144274af39 ("futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock")
+Reported-by: Michael Bommarito <michael.bommarito@gmail.com>
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Thomas Gleixner <tglx@kernel.org>
+Cc: stable@vger.kernel.org
+Link: https://patch.msgid.link/20260701131150.0Ijhq4Dw@linutronix.de
+Closes: https://lore.kernel.org/all/20260629020049.2082397-1-michael.bommarito@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/futex/requeue.c |    6 ------
+ 1 file changed, 6 deletions(-)
+
+--- a/kernel/futex/requeue.c
++++ b/kernel/futex/requeue.c
+@@ -643,12 +643,6 @@ retry_private:
+                               continue;
+                       }
+ 
+-                      /* Self-deadlock: non-top waiter already owns the PI futex. */
+-                      if (rt_mutex_owner(&pi_state->pi_mutex) == this->task) {
+-                              ret = -EDEADLK;
+-                              break;
+-                      }
+-
+                       ret = rt_mutex_start_proxy_lock(&pi_state->pi_mutex,
+                                                       this->rt_waiter,
+                                                       this->task);

diff --git a/queue-6.18/series b/queue-6.18/series
index d4cc67504dcf7b1f54549a857d8f77b097efeb25..e307ec6abd330e576db53d32d68a44e28fd2ab0a 100644 (file)
--- a/queue-6.18/series
+++ b/queue-6.18/series
@@ -38,3 +38,4 @@ rust-cpufreq-clean-new-clippy-map_or_identity-lint-for-rust-1.98.0.patch
 rust-block-fix-gendisk-cleanup-paths.patch
 rust-doctest-fix-incorrect-pattern-in-replacement.patch
 rust-kbuild-set-frame-pointer-llvm-module-flag-for-config_frame_pointer.patch
+futex-requeue-revert-prevent-null-pointer-dereference-in-remove_waiter-on-self-deadlock.patch