Bring back rtmutex remove_waiter() fixes ahead of RHEL; bump to 211.31.2

Re-add the rtmutex self-deadlock NULL deref fixes (upstream 3bfdc63936dd + 40a25d59e85b) as patches 1445/1446, previously shipped as 1418/1420 in 211.30.4 and temporarily dropped in 211.31.1.
2026-07-08 15:44:10 +00:00 · 2026-07-08 15:44:10 +00:00 · 98fac998eb
commit 98fac998eb
parent 5edaaf4d17
3 changed files with 166 additions and 2 deletions
--- a/1445-rtmutex-use-waiter-task-in-remove-waiter.patch
+++ b/1445-rtmutex-use-waiter-task-in-remove-waiter.patch
@ -0,0 +1,86 @@
+From 3bfdc63936dd4773109b7b8c280c0f3b5ae7d349 Mon Sep 17 00:00:00 2001
+From: Keenan Dong <keenanat2000@gmail.com>
+Date: Wed, 8 Apr 2026 16:46:00 +0800
+Subject: [PATCH] rtmutex: Use waiter::task instead of current in
+ remove_waiter()
+
+remove_waiter() is used by the slowlock paths, but it is also used for
+proxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from
+futex_requeue().
+
+In the latter case waiter::task is not current, but remove_waiter()
+operates on current for the dequeue operation. That results in several
+problems:
+
+  1) the rbtree dequeue happens without waiter::task::pi_lock being held
+
+  2) the waiter task's pi_blocked_on state is not cleared, which leaves a
+     dangling pointer primed for UAF around.
+
+  3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter
+     task
+
+Use waiter::task instead of current in all related operations in
+remove_waiter() to cure those problems.
+
+[ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the
+  	changelog ]
+
+Fixes: 8161239a8bcc ("rtmutex: Simplify PI algorithm and make highest prio task get lock")
+Reported-by: Yuan Tan <yuantan098@gmail.com>
+Reported-by: Yifan Wu <yifanwucs@gmail.com>
+Reported-by: Juefei Pu <tomapufckgml@gmail.com>
+Reported-by: Xin Liu <bird@lzu.edu.cn>
+Signed-off-by: Keenan Dong <keenanat2000@gmail.com>
+Signed-off-by: Thomas Gleixner <tglx@kernel.org>
+Cc: stable@vger.kernel.org
+
+(cherry picked from commit 3bfdc63936dd4773109b7b8c280c0f3b5ae7d349)
+[AlmaLinux: adapted to a10 (6.12); context/line offsets only. scoped_guard(raw_spinlock, ...) is available in this tree (include/linux/cleanup.h + DEFINE_LOCK_GUARD_1 raw_spinlock in include/linux/spinlock.h), so the upstream form is used verbatim.]
+---
+ kernel/locking/rtmutex.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c
+index 4a8df18..e6f305d 100644
+--- a/kernel/locking/rtmutex.c
+++ b/kernel/locking/rtmutex.c
+@@ -1534,20 +1534,23 @@ static bool rtmutex_spin_on_owner(struct rt_mutex_base *lock,
+  *
+  * Must be called with lock->wait_lock held and interrupts disabled. It must
+  * have just failed to try_to_take_rt_mutex().
+ *
+ * When invoked from rt_mutex_start_proxy_lock() waiter::task != current !
+  */
+ static void __sched remove_waiter(struct rt_mutex_base *lock,
+ 				  struct rt_mutex_waiter *waiter)
+ {
+ 	bool is_top_waiter = (waiter == rt_mutex_top_waiter(lock));
+ 	struct task_struct *owner = rt_mutex_owner(lock);
+	struct task_struct *waiter_task = waiter->task;
+ 	struct rt_mutex_base *next_lock;
+ 
+ 	lockdep_assert_held(&lock->wait_lock);
+ 
+-	raw_spin_lock(&current->pi_lock);
+-	rt_mutex_dequeue(lock, waiter);
+-	current->pi_blocked_on = NULL;
+-	raw_spin_unlock(&current->pi_lock);
+	scoped_guard(raw_spinlock, &waiter_task->pi_lock) {
+		rt_mutex_dequeue(lock, waiter);
+		waiter_task->pi_blocked_on = NULL;
+	}
+ 
+ 	/*
+ 	 * Only update priority if the waiter was the highest priority
+@@ -1583,7 +1586,7 @@ static void __sched remove_waiter(struct rt_mutex_base *lock,
+ 	raw_spin_unlock_irq(&lock->wait_lock);
+ 
+ 	rt_mutex_adjust_prio_chain(owner, RT_MUTEX_MIN_CHAINWALK, lock,
+-				   next_lock, NULL, current);
+				   next_lock, NULL, waiter_task);
+ 
+ 	raw_spin_lock_irq(&lock->wait_lock);
+ }
+-- 
+2.50.1
--- a/1446-rtmutex-skip-remove-waiter-when-not-enqueued.patch
+++ b/1446-rtmutex-skip-remove-waiter-when-not-enqueued.patch
@ -0,0 +1,70 @@
+From 40a25d59e85b3c8709ac2424d44f65610467871e Mon Sep 17 00:00:00 2001
+From: Davidlohr Bueso <dave@stgolabs.net>
+Date: Thu, 7 May 2026 04:29:13 -0700
+Subject: [PATCH] locking/rtmutex: Skip remove_waiter() when waiter is not
+ enqueued
+
+syzbot triggered the following splat in remove_waiter() via
+FUTEX_CMP_REQUEUE_PI:
+
+  KASAN: null-ptr-deref in range [0x0000000000000a88-0x0000000000000a8f]
+   class_raw_spinlock_constructor
+   remove_waiter+0x159/0x1200 kernel/locking/rtmutex.c:1561
+   rt_mutex_start_proxy_lock+0x103/0x120
+   futex_requeue+0x10e4/0x20d0
+   __x64_sys_futex+0x34f/0x4d0
+
+task_blocks_on_rt_mutex() does not arm the waiter upon deadlock detection,
+leaving waiter->task nil, where 3bfdc63936dd ("rtmutex: Use waiter::task instead
+of current in remove_waiter()") made this fatal.
+
+Furthermore, rt_mutex_start_proxy_lock() should not be calling into remove_waiter()
+upon a successfully grabbing the rtmutex. 1a1fb985f2e2 ("futex: Handle early deadlock
+return correctly"), moved the remove_waiter() out of __rt_mutex_start_proxy_lock()
+(where 'ret' was only ever 0 or < 0) into the wrapper. Tighten this check to
+account for try_to_take_rt_mutex().
+
+Fixes: 3bfdc63936dd ("rtmutex: Use waiter::task instead of current in remove_waiter()")
+Reported-by: syzbot+78147abe6c524f183ee9@syzkaller.appspotmail.com
+Signed-off-by: Davidlohr Bueso <dave@stgolabs.net>
+Signed-off-by: Thomas Gleixner <tglx@kernel.org>
+Cc: stable@vger.kernel.org
+Closes: https://lore.kernel.org/all/69f114ac.050a0220.ac8b.0003.GAE@google.com/
+Link: https://patch.msgid.link/20260507112913.1019537-1-dave@stgolabs.net
+
+(cherry picked from commit 40a25d59e85b3c8709ac2424d44f65610467871e)
+[AlmaLinux: adapted to a10 (6.12); context/line offsets only. Both hunks apply: remove_waiter() in kernel/locking/rtmutex.c (depends on waiter_task local from 3bfdc63936dd) and rt_mutex_start_proxy_lock() in kernel/locking/rtmutex_api.c. In this tree __rt_mutex_start_proxy_lock() returns 1 on try_to_take_rt_mutex() success, so the ret<0 tightening is required to avoid calling remove_waiter() on lock acquisition.]
+---
+ kernel/locking/rtmutex.c     | 3 +++
+ kernel/locking/rtmutex_api.c | 2 +-
+ 2 files changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c
+index e6f305d..15111dc 100644
+--- a/kernel/locking/rtmutex.c
+++ b/kernel/locking/rtmutex.c
+@@ -1547,6 +1547,9 @@ static void __sched remove_waiter(struct rt_mutex_base *lock,
+ 
+ 	lockdep_assert_held(&lock->wait_lock);
+ 
+	if (!waiter_task) /* never enqueued */
+		return;
+
+ 	scoped_guard(raw_spinlock, &waiter_task->pi_lock) {
+ 		rt_mutex_dequeue(lock, waiter);
+ 		waiter_task->pi_blocked_on = NULL;
+diff --git a/kernel/locking/rtmutex_api.c b/kernel/locking/rtmutex_api.c
+index 6614ccd..341a540 100644
+--- a/kernel/locking/rtmutex_api.c
+++ b/kernel/locking/rtmutex_api.c
+@@ -347,7 +347,7 @@ int __sched rt_mutex_start_proxy_lock(struct rt_mutex_base *lock,
+ 
+ 	raw_spin_lock_irq(&lock->wait_lock);
+ 	ret = __rt_mutex_start_proxy_lock(lock, waiter, task, &wake_q);
+-	if (unlikely(ret))
+	if (unlikely(ret < 0))
+ 		remove_waiter(lock, waiter);
+ 	preempt_disable();
+ 	raw_spin_unlock_irq(&lock->wait_lock);
+-- 
+2.50.1
--- a/kernel.spec
+++ b/kernel.spec
@ -176,13 +176,13 @@ Summary: The Linux kernel
 %define specrpmversion 6.12.0
 %define specversion 6.12.0
 %define patchversion 6.12
-%define pkgrelease 211.31.1
+%define pkgrelease 211.31.2
 %define kversion 6
 %define tarfile_release 6.12.0-211.7.1.el10_2
 # This is needed to do merge window version magic
 %define patchlevel 12
 # This allows pkg_release to have configurable %%{?dist} tag
-%define specrelease 211.31.1%{?buildid}%{?dist}
+%define specrelease 211.31.2%{?buildid}%{?dist}
 # This defines the kabi tarball version
 %define kabiversion 6.12.0-211.7.1.el10_2

@ -1475,6 +1475,8 @@ Patch1441: 1441-eventpoll-fix-semi-unbounded-recursion.patch
 Patch1442: 1442-eventpoll-drop-vestigial-epi-dying-flag.patch
 Patch1443: 1443-eventpoll-fix-integer-overflow-in-ep-loop-check-proc.patch
 Patch1444: 1444-eventpoll-refresh-epi-fget-ep-remove-file-comments.patch
+Patch1445: 1445-rtmutex-use-waiter-task-in-remove-waiter.patch
+Patch1446: 1446-rtmutex-skip-remove-waiter-when-not-enqueued.patch
 # END OF PATCH DEFINITIONS

 %description
@ -2672,6 +2674,8 @@ ApplyPatch 1441-eventpoll-fix-semi-unbounded-recursion.patch
 ApplyPatch 1442-eventpoll-drop-vestigial-epi-dying-flag.patch
 ApplyPatch 1443-eventpoll-fix-integer-overflow-in-ep-loop-check-proc.patch
 ApplyPatch 1444-eventpoll-refresh-epi-fget-ep-remove-file-comments.patch
+ApplyPatch 1445-rtmutex-use-waiter-task-in-remove-waiter.patch
+ApplyPatch 1446-rtmutex-skip-remove-waiter-when-not-enqueued.patch
 # END OF PATCH APPLICATIONS

 # Any further pre-build tree manipulations happen here.
@ -5176,6 +5180,10 @@ fi\
 #
 #
 %changelog
+* Wed Jul 08 2026 Andrew Lukoshko <alukoshko@almalinux.org> - 6.12.0-211.31.2
+- Bring back the rtmutex self-deadlock NULL pointer dereference fixes in
+  remove_waiter() ahead of RHEL, upstream 3bfdc63936dd + 40a25d59e85b (1445, 1446)
+
 * Wed Jul 08 2026 Andrew Lukoshko <alukoshko@almalinux.org> - 6.12.0-211.31.1
 - Recreate RHEL 6.12.0-211.31.1 from CentOS Stream 10 and upstream stable backports (1421-1444)
 - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1417) is superseded by