From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932247AbbCMP2G (ORCPT ); Fri, 13 Mar 2015 11:28:06 -0400 Received: from smtprelay0246.hostedemail.com ([216.40.44.246]:34839 "EHLO smtprelay.hostedemail.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1755928AbbCMPPV (ORCPT ); Fri, 13 Mar 2015 11:15:21 -0400 X-Session-Marker: 6E657665747340676F6F646D69732E6F7267 X-Spam-Summary: 2,0,0,,d41d8cd98f00b204,,::::::::::::::::,RULES_HIT:355:379:871:988:989:1183:1260:1277:1312:1313:1314:1345:1516:1518:1519:1522:1534:1593:1594:1595:1596:1692:1730:1747:1777:1792:2392:2393:2559:2562:2828:3138:3139:3140:3141:3142:3876:3877:5007:6114:6261:6642:6748:7281:7901:10004:10848:11604:11914:12517:12519:13895:14394:21080,0,RBL:none,CacheIP:none,Bayesian:0.5,0.5,0.5,Netcheck:none,DomainCache:0,MSF:not bulk,SPF:fn,MSBL:0,DNSBL:none,Custom_rules:0:0:0 X-HE-Tag: pin21_688acaf29740d X-Filterd-Recvd-Size: 2540 Message-Id: <20150313151517.785489999@goodmis.org> User-Agent: quilt/0.61-1 Date: Fri, 13 Mar 2015 11:15:11 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org, linux-rt-users Cc: Thomas Gleixner , Carsten Emde , Sebastian Andrzej Siewior , John Kacur , Paul Gortmaker , Subject: [PATCH RT 17/31] rt-mutex: avoid a NULL pointer dereference on deadlock References: <20150313151454.809081378@goodmis.org> MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-15 Content-Disposition: inline; filename=0017-rt-mutex-avoid-a-NULL-pointer-dereference-on-deadloc.patch Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 3.10.70-rt75-rc1 stable review patch. If anyone has any objections, please let me know. ------------------ From: Sebastian Andrzej Siewior With task_blocks_on_rt_mutex() returning early -EDEADLK we never add the waiter to the waitqueue. Later, we try to remove it via remove_waiter() and go boom in rt_mutex_top_waiter() because rb_entry() gives a NULL pointer. Tested on v3.18-RT where rtmutex is used for regular mutex and I tried to get one twice in a row. Not sure when this started but I guess 397335f00 ("rtmutex: Fix deadlock detector for real") or commit 3d5c9340 ("rtmutex: Handle deadlock detection smarter"). Cc: stable-rt@vger.kernel.org Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Steven Rostedt --- kernel/rtmutex.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/kernel/rtmutex.c b/kernel/rtmutex.c index b7b1de2acf0b..5388ba98acaf 100644 --- a/kernel/rtmutex.c +++ b/kernel/rtmutex.c @@ -1490,7 +1490,8 @@ rt_mutex_slowlock(struct rt_mutex *lock, int state, set_current_state(TASK_RUNNING); if (unlikely(ret)) { - remove_waiter(lock, &waiter); + if (rt_mutex_has_waiters(lock)) + remove_waiter(lock, &waiter); rt_mutex_handle_deadlock(ret, chwalk, &waiter); } -- 2.1.4