Andrew Lukoshko
3dfb5d4267
- Drop AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes (1445, 1446), superseded by RHEL's CVE-2026-43499 copies in 211.33.1 - Add RHEL 211.33.1 backports recreated from CS10/upstream (1451-1455), including the futex/requeue guard and its same-release revert (net zero, kept for changelog fidelity)
49 lines
1.9 KiB
Diff
49 lines
1.9 KiB
Diff
From 39def6d250d370298f86c116f4ac60093cefadaa Mon Sep 17 00:00:00 2001
|
|
From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
|
|
Date: Wed, 1 Jul 2026 15:11:50 +0200
|
|
Subject: [PATCH] futex/requeue: Revert "Prevent NULL pointer dereference in
|
|
remove_waiter() on self-deadlock""
|
|
|
|
The commit cited below should not have been merged. It attemted to fix an
|
|
existing problem ansd thereby introduced new problems by keeping the
|
|
pi_state in state Q_REQUEUE_PI_IN_PROGRESS and leaking it.
|
|
|
|
Based on the commit description the intention was to handle the case
|
|
when task_blocks_on_rt_mutex() returns -EDEADLK and the following
|
|
remove_waiter() dereferences the NULL pointer in waiter->task.
|
|
|
|
That is already handled by Davidlohr in commit 40a25d59e85b3
|
|
("locking/rtmutex: Skip remove_waiter() when waiter is not enqueued") and
|
|
requires no further acting.
|
|
|
|
Revert the commit breaking the "waiter == owner" case again.
|
|
|
|
Fixes: 74e144274af39 ("futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock")
|
|
Reported-by: Michael Bommarito <michael.bommarito@gmail.com>
|
|
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
|
|
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
|
|
Cc: stable@vger.kernel.org
|
|
Link: https://patch.msgid.link/20260701131150.0Ijhq4Dw@linutronix.de
|
|
Closes: https://lore.kernel.org/all/20260629020049.2082397-1-michael.bommarito@gmail.com
|
|
|
|
diff --git a/kernel/futex/requeue.c b/kernel/futex/requeue.c
|
|
index 7384672916fb..79823ad13683 100644
|
|
--- a/kernel/futex/requeue.c
|
|
+++ b/kernel/futex/requeue.c
|
|
@@ -645,12 +645,6 @@ int futex_requeue(u32 __user *uaddr1, unsigned int flags1,
|
|
continue;
|
|
}
|
|
|
|
- /* Self-deadlock: non-top waiter already owns the PI futex. */
|
|
- if (rt_mutex_owner(&pi_state->pi_mutex) == this->task) {
|
|
- ret = -EDEADLK;
|
|
- break;
|
|
- }
|
|
-
|
|
ret = rt_mutex_start_proxy_lock(&pi_state->pi_mutex,
|
|
this->rt_waiter,
|
|
this->task);
|
|
--
|
|
2.50.1 (Apple Git-155)
|
|
|