[PATCH] locking/lockdep: Fix NULL pointer dereference in __lock_set_class()

[PATCH] locking/lockdep: Fix NULL pointer dereference in __lock_set_class()

[Naveen Kumar Chaudhary]

register_lock_class() can return NULL when the lock class pool is
exhausted, graph_lock() fails, or key validation fails. However,
__lock_set_class() uses the return value directly in pointer arithmetic
without a NULL check:

  class = register_lock_class(lock, subclass, 0);
  hlock->class_idx = class - lock_classes;

If class is NULL, this computes a wild offset that corrupts
hlock->class_idx. The subsequent reacquire_held_locks() call will
invoke hlock_class() with this corrupted index, leading to a NULL or
out-of-bounds pointer dereference.

Add the missing NULL check, consistent with how __lock_acquire() already
handles this case at the same call site.

Fixes: 64aa348edc61 ("lockdep: lock_set_subclass - reset a held lock's subclass")
Signed-off-by: Naveen Kumar Chaudhary <naveen.osdev@gmail.com>
---
 kernel/locking/lockdep.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c
index 2d4c5bab5af8..e0de81114824 100644
--- a/kernel/locking/lockdep.c
+++ b/kernel/locking/lockdep.c
@@ -5437,6 +5437,8 @@ __lock_set_class(struct lockdep_map *lock, const char *name,
 			      lock->wait_type_outer,
 			      lock->lock_type);
 	class = register_lock_class(lock, subclass, 0);
+	if (!class)
+		return 0;
 	hlock->class_idx = class - lock_classes;
 
 	curr->lockdep_depth = i;
-- 
2.43.0

Re: [PATCH] locking/lockdep: Fix NULL pointer dereference in __lock_set_class()

[Waiman Long]

On 6/11/26 1:38 PM, Naveen Kumar Chaudhary wrote:
> register_lock_class() can return NULL when the lock class pool is
> exhausted, graph_lock() fails, or key validation fails. However,
> __lock_set_class() uses the return value directly in pointer arithmetic
> without a NULL check:
>
>    class = register_lock_class(lock, subclass, 0);
>    hlock->class_idx = class - lock_classes;
>
> If class is NULL, this computes a wild offset that corrupts
> hlock->class_idx. The subsequent reacquire_held_locks() call will
> invoke hlock_class() with this corrupted index, leading to a NULL or
> out-of-bounds pointer dereference.
>
> Add the missing NULL check, consistent with how __lock_acquire() already
> handles this case at the same call site.
>
> Fixes: 64aa348edc61 ("lockdep: lock_set_subclass - reset a held lock's subclass")
> Signed-off-by: Naveen Kumar Chaudhary <naveen.osdev@gmail.com>
> ---
>   kernel/locking/lockdep.c | 2 ++
>   1 file changed, 2 insertions(+)
>
> diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c
> index 2d4c5bab5af8..e0de81114824 100644
> --- a/kernel/locking/lockdep.c
> +++ b/kernel/locking/lockdep.c
> @@ -5437,6 +5437,8 @@ __lock_set_class(struct lockdep_map *lock, const char *name,
>   			      lock->wait_type_outer,
>   			      lock->lock_type);
>   	class = register_lock_class(lock, subclass, 0);
> +	if (!class)
> +		return 0;
>   	hlock->class_idx = class - lock_classes;
>   
>   	curr->lockdep_depth = i;
Reviewed-by: Waiman Long <longman@redhat.com>

[tip: locking/core] locking/lockdep: Fix NULL pointer dereference in __lock_set_class()

[tip-bot2 for Naveen Kumar Chaudhary]

The following commit has been merged into the locking/core branch of tip:

Commit-ID:     7577e00b9ab506202b9f1a33de3cc8cc6413a4db
Gitweb:        https://git.kernel.org/tip/7577e00b9ab506202b9f1a33de3cc8cc6413a4db
Author:        Naveen Kumar Chaudhary <naveen.osdev@gmail.com>
AuthorDate:    Thu, 11 Jun 2026 23:08:17 +05:30
Committer:     Peter Zijlstra <peterz@infradead.org>
CommitterDate: Fri, 31 Jul 2026 10:32:24 +02:00

locking/lockdep: Fix NULL pointer dereference in __lock_set_class()

register_lock_class() can return NULL when the lock class pool is
exhausted, graph_lock() fails, or key validation fails. However,
__lock_set_class() uses the return value directly in pointer arithmetic
without a NULL check:

  class = register_lock_class(lock, subclass, 0);
  hlock->class_idx = class - lock_classes;

If class is NULL, this computes a wild offset that corrupts
hlock->class_idx. The subsequent reacquire_held_locks() call will
invoke hlock_class() with this corrupted index, leading to a NULL or
out-of-bounds pointer dereference.

Add the missing NULL check, consistent with how __lock_acquire() already
handles this case at the same call site.

Fixes: 64aa348edc61 ("lockdep: lock_set_subclass - reset a held lock's subclass")
Signed-off-by: Naveen Kumar Chaudhary <naveen.osdev@gmail.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Waiman Long <longman@redhat.com>
Reviewed-by: Dmitry Ilvokhin <d@ilvokhin.com>
Link: https://patch.msgid.link/h2kfw43n4527x6mgi2lwpz2rieqnfzgictpv4wr5nyfjkc47co@2r5vz4uz44db
---
 kernel/locking/lockdep.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c
index ff4bbf1..25d77d4 100644
--- a/kernel/locking/lockdep.c
+++ b/kernel/locking/lockdep.c
@@ -5453,6 +5453,8 @@ __lock_set_class(struct lockdep_map *lock, const char *name,
 			      lock->wait_type_outer,
 			      lock->lock_type);
 	class = register_lock_class(lock, subclass, 0);
+	if (!class)
+		return 0;
 	hlock->class_idx = class - lock_classes;
 
 	curr->lockdep_depth = i;