Andrew Lukoshko
3dfb5d4267
- Drop AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes (1445, 1446), superseded by RHEL's CVE-2026-43499 copies in 211.33.1 - Add RHEL 211.33.1 backports recreated from CS10/upstream (1451-1455), including the futex/requeue guard and its same-release revert (net zero, kept for changelog fidelity)
43 lines
1.5 KiB
Diff
43 lines
1.5 KiB
Diff
From 74e144274af39935b0f410c0ee4d2b91c3730414 Mon Sep 17 00:00:00 2001
|
|
From: Ji'an Zhou <eilaimemedsnaimel@gmail.com>
|
|
Date: Tue, 2 Jun 2026 09:12:04 +0000
|
|
Subject: [PATCH] futex/requeue: Prevent NULL pointer dereference in
|
|
remove_waiter() on self-deadlock
|
|
|
|
When FUTEX_CMP_REQUEUE_PI requeues a non-top waiter that already owns the
|
|
target PI futex, task_blocks_on_rt_mutex() returns -EDEADLK before setting
|
|
waiter->task.
|
|
|
|
The subsequent remove_waiter() in rt_mutex_start_proxy_lock() dereferences
|
|
the NULL waiter->task, causing a kernel crash.
|
|
|
|
Add a self-deadlock check for non-top waiters before calling
|
|
rt_mutex_start_proxy_lock(), analogous to the top-waiter check in
|
|
futex_lock_pi_atomic().
|
|
|
|
Fixes: 3bfdc63936dd4773109b7b8c280c0f3b5ae7d349 ("rtmutex: Use waiter::task instead of current in remove_waiter()")
|
|
Signed-off-by: Ji'an Zhou <eilaimemedsnaimel@gmail.com>
|
|
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
|
|
Cc: stable@vger.kernel.org
|
|
|
|
diff --git a/kernel/futex/requeue.c b/kernel/futex/requeue.c
|
|
index b597cb3d17fc..1d99a84dc9ad 100644
|
|
--- a/kernel/futex/requeue.c
|
|
+++ b/kernel/futex/requeue.c
|
|
@@ -643,6 +643,12 @@ int futex_requeue(u32 __user *uaddr1, unsigned int flags1,
|
|
continue;
|
|
}
|
|
|
|
+ /* Self-deadlock: non-top waiter already owns the PI futex. */
|
|
+ if (rt_mutex_owner(&pi_state->pi_mutex) == this->task) {
|
|
+ ret = -EDEADLK;
|
|
+ break;
|
|
+ }
|
|
+
|
|
ret = rt_mutex_start_proxy_lock(&pi_state->pi_mutex,
|
|
this->rt_waiter,
|
|
this->task);
|
|
--
|
|
2.50.1 (Apple Git-155)
|
|
|