From: Greg Kroah-Hartman Date: Fri, 10 Jul 2026 12:04:05 +0000 (+0200) Subject: 7.1-stable patches X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=b3aa4495ee9869ce6e2832866107940f6c8b5576;p=thirdparty%2Fkernel%2Fstable-queue.git 7.1-stable patches added patches: futex-requeue-revert-prevent-null-pointer-dereference-in-remove_waiter-on-self-deadlock.patch --- diff --git a/queue-7.1/futex-requeue-revert-prevent-null-pointer-dereference-in-remove_waiter-on-self-deadlock.patch b/queue-7.1/futex-requeue-revert-prevent-null-pointer-dereference-in-remove_waiter-on-self-deadlock.patch new file mode 100644 index 0000000000..d49d2c362c --- /dev/null +++ b/queue-7.1/futex-requeue-revert-prevent-null-pointer-dereference-in-remove_waiter-on-self-deadlock.patch @@ -0,0 +1,50 @@ +From 39def6d250d370298f86c116f4ac60093cefadaa Mon Sep 17 00:00:00 2001 +From: Sebastian Andrzej Siewior +Date: Wed, 1 Jul 2026 15:11:50 +0200 +Subject: futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" + +From: Sebastian Andrzej Siewior + +commit 39def6d250d370298f86c116f4ac60093cefadaa upstream. + +The commit cited below should not have been merged. It attemted to fix an +existing problem ansd thereby introduced new problems by keeping the +pi_state in state Q_REQUEUE_PI_IN_PROGRESS and leaking it. + +Based on the commit description the intention was to handle the case +when task_blocks_on_rt_mutex() returns -EDEADLK and the following +remove_waiter() dereferences the NULL pointer in waiter->task. + +That is already handled by Davidlohr in commit 40a25d59e85b3 +("locking/rtmutex: Skip remove_waiter() when waiter is not enqueued") and +requires no further acting. + +Revert the commit breaking the "waiter == owner" case again. + +Fixes: 74e144274af39 ("futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock") +Reported-by: Michael Bommarito +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Thomas Gleixner +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/20260701131150.0Ijhq4Dw@linutronix.de +Closes: https://lore.kernel.org/all/20260629020049.2082397-1-michael.bommarito@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + kernel/futex/requeue.c | 6 ------ + 1 file changed, 6 deletions(-) + +--- a/kernel/futex/requeue.c ++++ b/kernel/futex/requeue.c +@@ -643,12 +643,6 @@ retry_private: + continue; + } + +- /* Self-deadlock: non-top waiter already owns the PI futex. */ +- if (rt_mutex_owner(&pi_state->pi_mutex) == this->task) { +- ret = -EDEADLK; +- break; +- } +- + ret = rt_mutex_start_proxy_lock(&pi_state->pi_mutex, + this->rt_waiter, + this->task); diff --git a/queue-7.1/series b/queue-7.1/series index 382bd00b8d..d34f661f8e 100644 --- a/queue-7.1/series +++ b/queue-7.1/series @@ -19,3 +19,4 @@ rust-pci-use-static-lifetime-for-pci-bar-resource-names.patch rust-block-fix-gendisk-cleanup-paths.patch rust-doctest-fix-incorrect-pattern-in-replacement.patch rust-kbuild-set-frame-pointer-llvm-module-flag-for-config_frame_pointer.patch +futex-requeue-revert-prevent-null-pointer-dereference-in-remove_waiter-on-self-deadlock.patch