[rlc-8/4.18.0-553.139.1.el8_10] Multiple patches tested (2 commits)

[ciq-kernel-automation]

Summary

This PR has been automatically created after successful completion of all CI stages.

Commit Message(s)

rtmutex: Use waiter::task instead of current in remove_waiter()

cve CVE-2026-43499
commit-author Keenan Dong <keenanat2000@gmail.com>
commit 3bfdc63936dd4773109b7b8c280c0f3b5ae7d349
upstream-diff |
        This tree builds with -std=gnu89, which rejects upstream's
        scoped_guard() form (cleanup.h expands it to a for-loop that
        declares a variable in the initializer), so an explicit
        raw_spin_lock()/raw_spin_unlock() pair on waiter_task->pi_lock is
        used instead. The locking is identical; the comment, the
        waiter_task local, and the rt_mutex_adjust_prio_chain() argument
        match upstream.

locking/rtmutex: Skip remove_waiter() when waiter is not enqueued

cve CVE-2026-53163
commit-author Davidlohr Bueso <dave@stgolabs.net>
commit 40a25d59e85b3c8709ac2424d44f65610467871e
upstream-diff |
        Functionally identical. In rtmutex_api.c the remove_waiter() call
        is gated on ret < 0 (skipped on the ret == 1 acquired path); this
        tree's __rt_mutex_start_proxy_lock() has no @wake_q and no
        preempt_disable() around the wait_lock release (later reworks), so
        only the context was adjusted. In rtmutex.c the !waiter_task guard
        is verbatim, atop the explicit-lock form from the previous commit.

Test Results

✅ Build Stage

Architecture	Build Time	Total Time
x86_64	24m 8s	25m 7s
aarch64	10m 31s	11m 14s

• View build logs

✅ Boot Verification

• Status: Passed (all architectures)
• View boot logs

✅ Kernel Selftests

Architecture	Passed	Failed	Compared Against	Status
x86_64	120	36	rlc-8/4.18.0-553.139.1.el8_10	✅ No regressions
aarch64	72	32	rlc-8/4.18.0-553.139.1.el8_10	✅ No regressions

• View kselftest logs

✅ LTP Results

Architecture	Passed	Failed	Compared Against	Status
x86_64	1408	84	rlc-8/4.18.0-553.139.1.el8_10	❌ 1 regressions
aarch64	1381	83	rlc-8/4.18.0-553.139.1.el8_10	✅ No regressions

• View LTP logs

x86_64 regressions:

• futex_wake02 (PASS -> FAIL)

---

🤖 This PR was automatically generated by GitHub Actions
Run ID: 29075373448

[github-actions]

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/29087159747

[github-actions]

🔍 Upstream Linux Kernel Commit Check

• ⚠️ PR commit 653186d8bee3 (rtmutex: Use waiter::task instead of current in remove_waiter()) references upstream commit
  3bfdc63936dd which has been referenced by a Fixes: tag in the upstream
  Linux kernel:

    74e144274af3 futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Ji'an Zhou) (CVE-2026-53166)

This is an automated message from the kernel commit checker workflow.

[github-actions]

🔍 Interdiff Analysis

• ⚠️ PR commit 653186d8bee3 (rtmutex: Use waiter::task instead of current in remove_waiter()) → upstream 3bfdc63936dd
  Differences found:

================================================================================
*    DELTA DIFFERENCES - code changes that differ between the patches          *
================================================================================

--- b/kernel/locking/rtmutex.c
+++ b/kernel/locking/rtmutex.c
@@ -1514,10 +1514,10 @@
 
 	lockdep_assert_held(&lock->wait_lock);
 
-	raw_spin_lock(&waiter_task->pi_lock);
-	rt_mutex_dequeue(lock, waiter);
-	waiter_task->pi_blocked_on = NULL;
-	raw_spin_unlock(&waiter_task->pi_lock);
+	scoped_guard(raw_spinlock, &waiter_task->pi_lock) {
+		rt_mutex_dequeue(lock, waiter);
+		waiter_task->pi_blocked_on = NULL;
+	}
 
 	/*
 	 * Only update priority if the waiter was the highest priority

• ⚠️ PR commit 23804269a978 (locking/rtmutex: Skip remove_waiter() when waiter is not enqueued) → upstream 40a25d59e85b
  Differences found:

################################################################################
!    REJECTED PATCH2 HUNKS - could not be compared; manual review needed       !
################################################################################

--- b/kernel/locking/rtmutex.c
+++ b/kernel/locking/rtmutex.c
@@ -1558,6 +1558,9 @@
 
 	lockdep_assert_held(&lock->wait_lock);
 
+	if (!waiter_task) /* never enqueued */
+		return;
+
 	scoped_guard(raw_spinlock, &waiter_task->pi_lock) {
 		rt_mutex_dequeue(lock, waiter);
 		waiter_task->pi_blocked_on = NULL;
--- b/kernel/locking/rtmutex_api.c
+++ b/kernel/locking/rtmutex_api.c
@@ -365,7 +365,7 @@
 
 	raw_spin_lock_irq(&lock->wait_lock);
 	ret = __rt_mutex_start_proxy_lock(lock, waiter, task, &wake_q);
-	if (unlikely(ret))
+	if (unlikely(ret < 0))
 		remove_waiter(lock, waiter);
 	preempt_disable();
 	raw_spin_unlock_irq(&lock->wait_lock);

================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/kernel/locking/rtmutex.c
+++ b/kernel/locking/rtmutex.c
@@ -1511,6 +1511,6 @@
 
 	lockdep_assert_held(&lock->wait_lock);
 
-	raw_spin_lock(&waiter_task->pi_lock);
-	rt_mutex_dequeue(lock, waiter);
-	waiter_task->pi_blocked_on = NULL;
+	scoped_guard(raw_spinlock, &waiter_task->pi_lock) {
+		rt_mutex_dequeue(lock, waiter);
+		waiter_task->pi_blocked_on = NULL;
--- b/kernel/locking/rtmutex_api.c
+++ b/kernel/locking/rtmutex_api.c
@@ -320,5 +320,6 @@
 	raw_spin_lock_irq(&lock->wait_lock);
-	ret = __rt_mutex_start_proxy_lock(lock, waiter, task);
+	ret = __rt_mutex_start_proxy_lock(lock, waiter, task, &wake_q);
 	if (unlikely(ret))
 		remove_waiter(lock, waiter);
+	preempt_disable();
 	raw_spin_unlock_irq(&lock->wait_lock);

This is an automated interdiff check for backported commits.

[github-actions]

✅ Validation checks completed successfully View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/29087159747

[bmastbergen]

🥌