From: Andrei Vagin Date: Sat, 14 Mar 2026 18:26:07 +0000 (+0000) Subject: locking/rwsem: Fix logic error in rwsem_del_waiter() X-Git-Tag: v7.1-rc1~199^2~9 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=68bcd8b6e0b10d902f7fc8bf3f08f335f5d1640e;p=thirdparty%2Fkernel%2Flinux.git locking/rwsem: Fix logic error in rwsem_del_waiter() Commit 1ea4b473504b ("locking/rwsem: Remove the list_head from struct rw_semaphore") introduced a logic error in rwsem_del_waiter(). The root cause of this issue is an inconsistency in the return values of __rwsem_del_waiter() and rwsem_del_waiter(). Specifically, __rwsem_del_waiter() returns true when the wait list becomes empty, whereas rwsem_del_waiter() is supposed to return true if the wait list is NOT empty. This caused a null pointer dereference in rwsem_mark_wake() because it was being called when sem->first_waiter was NULL. Fixes: 1ea4b473504b ("locking/rwsem: Remove the list_head from struct rw_semaphore") Reported-by: syzbot+3d2ff92c67127d337463@syzkaller.appspotmail.com Signed-off-by: Andrei Vagin Signed-off-by: Peter Zijlstra (Intel) Tested-by: syzbot+3d2ff92c67127d337463@syzkaller.appspotmail.com Link: https://patch.msgid.link/20260314182607.3343346-1-avagin@google.com --- diff --git a/kernel/locking/rwsem.c b/kernel/locking/rwsem.c index ba4cb74de0644..bf647097369cb 100644 --- a/kernel/locking/rwsem.c +++ b/kernel/locking/rwsem.c @@ -370,7 +370,7 @@ bool __rwsem_del_waiter(struct rw_semaphore *sem, struct rwsem_waiter *waiter) { if (list_empty(&waiter->list)) { sem->first_waiter = NULL; - return true; + return false; } if (sem->first_waiter == waiter) { @@ -379,7 +379,7 @@ bool __rwsem_del_waiter(struct rw_semaphore *sem, struct rwsem_waiter *waiter) } list_del(&waiter->list); - return false; + return true; } /*