qiurui/Centos-kernel-stream-10
1
0
Fork 0
mirror of https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10.git synced 2026-09-09 00:07:04 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge: [Exploits (KEV)] CVE-2026-53166 kernel: futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock

Browse Source 
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/2902

JIRA: https://redhat.atlassian.net/browse/RHEL-193249
CVE: CVE-2026-53166
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/2902

The CVE references commit 74e144274af3 ("futex/requeue: Prevent
NULL pointer dereference in remove_waiter() on self-deadlock"), but
it was reverted upstream and commit 40a25d59e85b ("locking/rtmutex:
Skip remove_waiter() when waiter is not enqueued") is regarded as the
proper fix for the same problem. So all of them are included in this
MR for completeness.

Signed-off-by: Waiman Long <longman@redhat.com>

Approved-by: Jay Shin <jaeshin@redhat.com>
Approved-by: Phil Auld <pauld@redhat.com>
Approved-by: Oleg Nesterov <oleg@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>

Merged-by: Alexandra Hájková <ahajkova@redhat.com>
This commit is contained in:
Alexandra Hájková
2026-07-14 19:41:11 +02:00
parent 419955f12c ca4ed62a09
commit 8ef46edb6c
2 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
kernel/locking/rtmutex.c
+3
View File
@@ -1547,6 +1547,9 @@ static void __sched remove_waiter(struct rt_mutex_base *lock,
lockdep_assert_held(&lock->wait_lock);
if (!waiter_task) /* never enqueued */
return;
scoped_guard(raw_spinlock, &waiter_task->pi_lock) {
rt_mutex_dequeue(lock, waiter);
waiter_task->pi_blocked_on = NULL;
kernel/locking/rtmutex_api.c
+1 -1
View File
@@ -347,7 +347,7 @@ int __sched rt_mutex_start_proxy_lock(struct rt_mutex_base *lock,
raw_spin_lock_irq(&lock->wait_lock);
ret = __rt_mutex_start_proxy_lock(lock, waiter, task, &wake_q);
if (unlikely(ret))
if (unlikely(ret < 0))
remove_waiter(lock, waiter);
preempt_disable();
raw_spin_unlock_irq(&lock->wait_lock);