From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7E050301004 for ; Mon, 16 Mar 2026 17:49:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773683361; cv=none; b=MpMYBrBPDAtXDxKBFjQb4ILMKnsuxeiC4PRR4waToB/emi/Bsy4z1S0GDrWfTByVC2e/qR4WEG8HgbmV7jJ0+t/bxesuwbJL3oJk2mx4YXvcV9bbhV6rkEc8E1+11pZgXINAar5RRxZTq7nEz/Q+R5XXXykUtIhuW7s3g75DlBY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773683361; c=relaxed/simple; bh=Fe6lGiTgyWWVhwdRe3Zxkj1yJRI8zQ5cCCFntSxMYWw=; h=From:Message-ID:Date:MIME-Version:Subject:To:Cc:References: In-Reply-To:Content-Type; b=G2cvSDP1ITPlQZwcSy7Al71LdPemE0orst9rTLojoONGQbTJnCoElofsmAVBqMCYvT3t7WAI4bA9GsCRu+dZ8XEm0Byz14j9rgO8DLb+JnGoCmvJkCt1pehtgGS8/IABPTbTGThf7O/lSGGWqCaV9aYYX8k+ywV37m7NrVOSlHI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=SkpyPPFs; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b=enBrXcv5; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="SkpyPPFs"; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b="enBrXcv5" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1773683359; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=BXOjEn+HQ+XzWPVDKS9Zc2ybZvDzOxNrptg7xnTnHXY=; b=SkpyPPFsYg/l/XPcdPRFTWhArSqIZMcVLMmqO5/2uVbPV8eG00HUCrMj/z6flsw5yk9WQd kQ1P58lTPkIjnHY2BWGCF/gfXL7w04kPdYToc8+AW1AGUfTNShQJlG6rxKtVtd3vOEfJox hde3mZxyPA+Nvwg738H5dFUBRXIu65A= Received: from mail-qt1-f197.google.com (mail-qt1-f197.google.com [209.85.160.197]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-621-NB4TIlwbPGyeNNUaOnyDgA-1; Mon, 16 Mar 2026 13:49:18 -0400 X-MC-Unique: NB4TIlwbPGyeNNUaOnyDgA-1 X-Mimecast-MFC-AGG-ID: NB4TIlwbPGyeNNUaOnyDgA_1773683358 Received: by mail-qt1-f197.google.com with SMTP id d75a77b69052e-509044f54aaso394783651cf.1 for ; Mon, 16 Mar 2026 10:49:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1773683358; x=1774288158; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:content-language:references :cc:to:subject:user-agent:mime-version:date:message-id:from:from:to :cc:subject:date:message-id:reply-to; bh=BXOjEn+HQ+XzWPVDKS9Zc2ybZvDzOxNrptg7xnTnHXY=; b=enBrXcv5+Xp4pMoDWb76/WFYH3ECMVHeNW21CxHQV0oTn60DSla0RVLk45TYwZ2nBp Jlnci091dPUxgDthSvEibBHhCUAzBJZZAFj0Bk0uRaFLASD9rhQp0Ji5gk8e1tUYl96b fxtefS9zohDSkP6Nl2Pe/fotg/3Ze7H3epCbbGVg8yomoEL0HTLJia/kVi87R1PDxn7H O/mDMAKzbaMYH0OJFso91zQVSM04/BRM2WIcI/M9p95RjWjFl9G2asPFnf0agDVjVddg 8Crsv0LCXhjX+9/F0wbOGGeNL1NUTh85v0gnqGq0kueLtHOmiZgaZJq4oYyXF3aNKkOh uPAw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1773683358; x=1774288158; h=content-transfer-encoding:in-reply-to:content-language:references :cc:to:subject:user-agent:mime-version:date:message-id:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=BXOjEn+HQ+XzWPVDKS9Zc2ybZvDzOxNrptg7xnTnHXY=; b=ldzYqL5vBDt717QKnZHITlf9Y+tjb8gfRHZwiWJjsSTmNr1sPmEC+JnzEKma39CxsL 43HNgYYTTeSTyOmRFdca522OALb79bMdEqfYPAMjQCOo1/01PcP6uDUU0H0kr0fd4pwa 3WhR763G3r/SQQyBq5Az252gyBrebybkY+uMur1F+uggLMqUlt/prx/zCs1eKx8Yjf1K 5lucp9ofqhVYVRrfcDepAvUKdEzZ57jxdtgdgWvdYwtp3Zt0bSvi75LsORM9XgrOKQj4 P65BamQZkBrod7IUZi4rp7dM1T9HSjwgqgOUghMQDHM1YWHgOxANhFv8iMXOc7L6yT3h ccrQ== X-Forwarded-Encrypted: i=1; AJvYcCV8UXOZk4hCxRErrDffa6z5wCAZFiVUoFU2nb8yelabJOkND8zd4kRIxtFXKhUqAx5Bx1W7KEha6+6wTn4=@vger.kernel.org X-Gm-Message-State: AOJu0YxNIfMpr4ZKM/EP3PkjIEQigrKzDghR8ds8Y6IztE+k3PEZ8DzF 7+YdalKzx5dCKiwfWow8m6/GA/4VFhRpB1V4OK1hAnxLLEowX7mic7wYgryFBtfqPSDcKn9K5Zq uaOQZoz2qa/cHHHoT3TFAhQaKC8Sn7fMMGXK/abUabMeBA6m2ExXotKIfSl3sjCgJ0g== X-Gm-Gg: ATEYQzx5q+UI35oMw6Ru9ZTQAJ7Ip6FUQUrJZ3McgR9cb2XccY7nIxGzBHxHMlyuF3M hL8gaim2j+c/IkI7HN1Q+TAnw36FTHJUg/J3AW3J+vo97Lko8LPbqmKIXTA8qMpZcw1qUx+IoH/ VoKpkScLrHG3PiX5nCMKB339re3J/d8TxpilB56vbjROBVFcQ/iDb0vH++IDsVmhhVq4XQZb8TE usZJhey2+osTFXKV/rhTZGvWqQuBn6i6YM0LELLBM16tF9KolkDkAy9Ffcf64r2RqQNCmogqsDx 6mgig6DxHG4FCUMxuMyTUTJ62kt1A7YMJ3Z6wWeSE/Ums1utu2flh15wqzIKXEXT7ii7mgVmGbo Xup0IutqUnCg6EpLIozY2PH81hkPdwSQwpC2xwHlNu/X9HbjV2dRk5ORW8bQvu31L2d71 X-Received: by 2002:a05:622a:156:b0:509:1d55:635e with SMTP id d75a77b69052e-50957eaae47mr187984431cf.65.1773683357765; Mon, 16 Mar 2026 10:49:17 -0700 (PDT) X-Received: by 2002:a05:622a:156:b0:509:1d55:635e with SMTP id d75a77b69052e-50957eaae47mr187984151cf.65.1773683357423; Mon, 16 Mar 2026 10:49:17 -0700 (PDT) Received: from ?IPV6:2601:188:c102:b180:1f8b:71d0:77b1:1f6e? ([2601:188:c102:b180:1f8b:71d0:77b1:1f6e]) by smtp.gmail.com with ESMTPSA id d75a77b69052e-50939e8d4bbsm124307521cf.4.2026.03.16.10.49.16 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 16 Mar 2026 10:49:16 -0700 (PDT) From: Waiman Long X-Google-Original-From: Waiman Long Message-ID: <5927a9df-3e06-4b92-bc84-75188290967d@redhat.com> Date: Mon, 16 Mar 2026 13:49:15 -0400 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] locking/rwsem: Fix logic error in rwsem_del_waiter() To: Andrei Vagin , "Matthew Wilcox (Oracle)" , Peter Zijlstra Cc: Ingo Molnar , Will Deacon , Boqun Feng , linux-kernel@vger.kernel.org, syzbot+3d2ff92c67127d337463@syzkaller.appspotmail.com References: <20260314182607.3343346-1-avagin@google.com> <025cdbad-99e1-4342-9f37-2564c555a8d1@redhat.com> Content-Language: en-US In-Reply-To: <025cdbad-99e1-4342-9f37-2564c555a8d1@redhat.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit On 3/16/26 1:34 PM, Waiman Long wrote: > On 3/14/26 2:26 PM, Andrei Vagin wrote: >> Commit 1ea4b473504b ("locking/rwsem: Remove the list_head from struct >> rw_semaphore") introduced a logic error in rwsem_del_waiter(). >> >> The root cause of this issue is an inconsistency in the return values of >> __rwsem_del_waiter() and rwsem_del_waiter(). Specifically, >> __rwsem_del_waiter() returns true when the wait list becomes empty, >> whereas rwsem_del_waiter() is supposed to return true if the wait list >> is NOT empty. >> >> This caused a null pointer dereference in rwsem_mark_wake() because it >> was being called when sem->first_waiter was NULL. >> >> Cc: Matthew Wilcox (Oracle) >> Reported-by:syzbot+3d2ff92c67127d337463@syzkaller.appspotmail.com >> Tested-by:syzbot+3d2ff92c67127d337463@syzkaller.appspotmail.com >> Fixes: 1ea4b473504b ("locking/rwsem: Remove the list_head from struct rw_semaphore") >> Signed-off-by: Andrei Vagin >> --- >> kernel/locking/rwsem.c | 4 ++-- >> 1 file changed, 2 insertions(+), 2 deletions(-) >> >> diff --git a/kernel/locking/rwsem.c b/kernel/locking/rwsem.c >> index ba4cb74de064..bf647097369c 100644 >> --- a/kernel/locking/rwsem.c >> +++ b/kernel/locking/rwsem.c >> @@ -370,7 +370,7 @@ bool __rwsem_del_waiter(struct rw_semaphore *sem, struct rwsem_waiter *waiter) >> { >> if (list_empty(&waiter->list)) { >> sem->first_waiter = NULL; >> - return true; >> + return false; >> } >> >> if (sem->first_waiter == waiter) { >> @@ -379,7 +379,7 @@ bool __rwsem_del_waiter(struct rw_semaphore *sem, struct rwsem_waiter *waiter) >> } >> list_del(&waiter->list); >> >> - return false; >> + return true; >> } >> >> /* > > It will be better if we also document what does the return value of > __rwsem_del_waiter() means as the we can't guess from the function > name itself. Other that that, > > Reviewed-by: Waiman Long > Thinking a bit more about it. I think it will be better to not return a value in __rwsem_del_waiter() at all. Something like diff --git a/kernel/locking/rwsem.c b/kernel/locking/rwsem.c index ba4cb74de064..ce57ad3c1120 100644 --- a/kernel/locking/rwsem.c +++ b/kernel/locking/rwsem.c @@ -365,12 +365,11 @@ enum rwsem_wake_type { #define MAX_READERS_WAKEUP 0x100 static inline -bool __rwsem_del_waiter(struct rw_semaphore *sem, struct rwsem_waiter *waiter) +void __rwsem_del_waiter(struct rw_semaphore *sem, struct rwsem_waiter *waiter) __must_hold(&sem->wait_lock) { if (list_empty(&waiter->list)) { sem->first_waiter = NULL; - return true; } if (sem->first_waiter == waiter) { @@ -378,8 +377,6 @@ bool __rwsem_del_waiter(struct rw_semaphore *sem, struct rwsem_waiter *waiter) struct rwsem_waiter, list); } list_del(&waiter->list); - - return false; } /* @@ -394,7 +391,8 @@ static inline bool rwsem_del_waiter(struct rw_semaphore *sem, struct rwsem_waiter *waiter) { lockdep_assert_held(&sem->wait_lock); - if (__rwsem_del_waiter(sem, waiter)) + __rwsem_del_waiter(sem, waiter); + if (rwsem_is_contended(sem)) return true; atomic_long_andnot(RWSEM_FLAG_HANDOFF | RWSEM_FLAG_WAITERS, &sem->count); return false; Cheers, Longman