From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756643AbbCMPUO (ORCPT ); Fri, 13 Mar 2015 11:20:14 -0400 Received: from smtprelay0054.hostedemail.com ([216.40.44.54]:33859 "EHLO smtprelay.hostedemail.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1756136AbbCMPSC (ORCPT ); Fri, 13 Mar 2015 11:18:02 -0400 X-Session-Marker: 6E657665747340676F6F646D69732E6F7267 X-Spam-Summary: 2,0,0,,d41d8cd98f00b204,,::::::::::::::::,RULES_HIT:355:379:871:988:989:1183:1260:1277:1312:1313:1314:1345:1516:1518:1519:1522:1534:1593:1594:1595:1596:1692:1730:1747:1777:1792:2392:2393:2559:2562:2828:3138:3139:3140:3141:3142:3876:3877:5007:6114:6261:6642:6748:7281:7901:10004:10848:11604:11914:12517:12519:13895:14394:21080,0,RBL:none,CacheIP:none,Bayesian:0.5,0.5,0.5,Netcheck:none,DomainCache:0,MSF:not bulk,SPF:fn,MSBL:0,DNSBL:none,Custom_rules:0:0:0 X-HE-Tag: jelly89_7fd335507044e X-Filterd-Recvd-Size: 2541 Message-Id: <20150313151757.724517846@goodmis.org> User-Agent: quilt/0.61-1 Date: Fri, 13 Mar 2015 11:17:58 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org, linux-rt-users Cc: Thomas Gleixner , Carsten Emde , Sebastian Andrzej Siewior , John Kacur , Paul Gortmaker , Subject: [PATCH RT 17/27] rt-mutex: avoid a NULL pointer dereference on deadlock References: <20150313151741.132137234@goodmis.org> MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-15 Content-Disposition: inline; filename=0017-rt-mutex-avoid-a-NULL-pointer-dereference-on-deadloc.patch Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 3.4.106-rt132-rc1 stable review patch. If anyone has any objections, please let me know. ------------------ From: Sebastian Andrzej Siewior With task_blocks_on_rt_mutex() returning early -EDEADLK we never add the waiter to the waitqueue. Later, we try to remove it via remove_waiter() and go boom in rt_mutex_top_waiter() because rb_entry() gives a NULL pointer. Tested on v3.18-RT where rtmutex is used for regular mutex and I tried to get one twice in a row. Not sure when this started but I guess 397335f00 ("rtmutex: Fix deadlock detector for real") or commit 3d5c9340 ("rtmutex: Handle deadlock detection smarter"). Cc: stable-rt@vger.kernel.org Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Steven Rostedt --- kernel/rtmutex.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/kernel/rtmutex.c b/kernel/rtmutex.c index 1889aedfad86..4cc273b85beb 100644 --- a/kernel/rtmutex.c +++ b/kernel/rtmutex.c @@ -1487,7 +1487,8 @@ rt_mutex_slowlock(struct rt_mutex *lock, int state, set_current_state(TASK_RUNNING); if (unlikely(ret)) { - remove_waiter(lock, &waiter); + if (rt_mutex_has_waiters(lock)) + remove_waiter(lock, &waiter); rt_mutex_handle_deadlock(ret, chwalk, &waiter); } -- 2.1.4