Ji'an Zhou 16f8e17184 futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock ...

commit 74e144274a upstream.

When FUTEX_CMP_REQUEUE_PI requeues a non-top waiter that already owns the
target PI futex, task_blocks_on_rt_mutex() returns -EDEADLK before setting
waiter->task.

The subsequent remove_waiter() in rt_mutex_start_proxy_lock() dereferences
the NULL waiter->task, causing a kernel crash.

Add a self-deadlock check for non-top waiters before calling
rt_mutex_start_proxy_lock(), analogous to the top-waiter check in
futex_lock_pi_atomic().

Fixes: 3bfdc63936 ("rtmutex: Use waiter::task instead of current in remove_waiter()")
Signed-off-by: Ji'an Zhou <eilaimemedsnaimel@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2026-06-19 13:44:07 +02:00

..

core.c

futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy()

2026-04-02 13:23:33 +02:00

futex.h

…

Makefile

…

pi.c

…

requeue.c

futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock

2026-06-19 13:44:07 +02:00

syscalls.c

futex: Require sys_futex_requeue() to have identical flags

2026-04-02 13:23:33 +02:00

waitwake.c

…