[ciqlts8_6] Multiple patches tested (2 commits) by ciq-kernel-automation[bot] · Pull Request #1429 · ctrliq/kernel-src-tree

ciq-kernel-automation · 2026-07-10T10:57:43Z

Summary

This PR has been automatically created after successful completion of all CI stages.

Commit Message(s)

rtmutex: Use waiter::task instead of current in remove_waiter()

jira VULN-191593
cve CVE-2026-43499
commit-author Keenan Dong <keenanat2000@gmail.com>
commit 3bfdc63936dd4773109b7b8c280c0f3b5ae7d349
upstream-diff |
        This tree has no cleanup.h scoped_guard(), so upstream's
        scoped_guard(raw_spinlock, &waiter_task->pi_lock) stays an explicit
        raw_spin_lock()/raw_spin_unlock() pair, just retargeted from
        current to waiter_task. Functionally identical; the rest of the
        hunk matches upstream verbatim.

locking/rtmutex: Skip remove_waiter() when waiter is not enqueued

jira VULN-190206
cve CVE-2026-53163
commit-author Davidlohr Bueso <dave@stgolabs.net>
commit 40a25d59e85b3c8709ac2424d44f65610467871e
upstream-diff |
        The rtmutex.c !waiter_task guard is verbatim. In rtmutex_api.c the
        patched line matches upstream (remove_waiter() gated on ret < 0 so
        it's skipped on the ret == 1 lock-acquired path), but this tree's
        __rt_mutex_start_proxy_lock() has no @wake_q arg and no
        preempt_disable() around the wait_lock release (later reworks), so
        only the context was adjusted.

Test Results

✅ Build Stage

Architecture	Build Time	Total Time
x86_64	19m 10s	20m 9s
aarch64	10m 8s	10m 46s

View build logs

✅ Boot Verification

Status: Passed (all architectures)
View boot logs

✅ Kernel Selftests

Architecture	Passed	Failed	Compared Against	Status
x86_64	108	31	ciqlts8_6	✅ No regressions
aarch64	66	21	ciqlts8_6	✅ No regressions

View kselftest logs

✅ LTP Results

Architecture	Passed	Failed	Compared Against	Status
x86_64	1430	13	ciqlts8_6	✅ No regressions
aarch64	1426	13	ciqlts8_6	✅ No regressions

View LTP logs

🤖 This PR was automatically generated by GitHub Actions
Run ID: 29075367697

jira VULN-191593 cve CVE-2026-43499 commit-author Keenan Dong <keenanat2000@gmail.com> commit 3bfdc63 upstream-diff | This tree has no cleanup.h scoped_guard(), so upstream's scoped_guard(raw_spinlock, &waiter_task->pi_lock) stays an explicit raw_spin_lock()/raw_spin_unlock() pair, just retargeted from current to waiter_task. Functionally identical; the rest of the hunk matches upstream verbatim. remove_waiter() is used by the slowlock paths, but it is also used for proxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from futex_requeue(). In the latter case waiter::task is not current, but remove_waiter() operates on current for the dequeue operation. That results in several problems: 1) the rbtree dequeue happens without waiter::task::pi_lock being held 2) the waiter task's pi_blocked_on state is not cleared, which leaves a dangling pointer primed for UAF around. 3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter task Use waiter::task instead of current in all related operations in remove_waiter() to cure those problems. [ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the changelog ] Fixes: 8161239 ("rtmutex: Simplify PI algorithm and make highest prio task get lock") Reported-by: Yuan Tan <yuantan098@gmail.com> Reported-by: Yifan Wu <yifanwucs@gmail.com> Reported-by: Juefei Pu <tomapufckgml@gmail.com> Reported-by: Xin Liu <bird@lzu.edu.cn> Signed-off-by: Keenan Dong <keenanat2000@gmail.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Cc: stable@vger.kernel.org (cherry picked from commit 3bfdc63) Signed-off-by: Sultan Alsawaf <sultan@ciq.com>

jira VULN-190206 cve CVE-2026-53163 commit-author Davidlohr Bueso <dave@stgolabs.net> commit 40a25d5 upstream-diff | The rtmutex.c !waiter_task guard is verbatim. In rtmutex_api.c the patched line matches upstream (remove_waiter() gated on ret < 0 so it's skipped on the ret == 1 lock-acquired path), but this tree's __rt_mutex_start_proxy_lock() has no @wake_q arg and no preempt_disable() around the wait_lock release (later reworks), so only the context was adjusted. syzbot triggered the following splat in remove_waiter() via FUTEX_CMP_REQUEUE_PI: KASAN: null-ptr-deref in range [0x0000000000000a88-0x0000000000000a8f] class_raw_spinlock_constructor remove_waiter+0x159/0x1200 kernel/locking/rtmutex.c:1561 rt_mutex_start_proxy_lock+0x103/0x120 futex_requeue+0x10e4/0x20d0 __x64_sys_futex+0x34f/0x4d0 task_blocks_on_rt_mutex() does not arm the waiter upon deadlock detection, leaving waiter->task nil, where 3bfdc63 ("rtmutex: Use waiter::task instead of current in remove_waiter()") made this fatal. Furthermore, rt_mutex_start_proxy_lock() should not be calling into remove_waiter() upon a successfully grabbing the rtmutex. 1a1fb98 ("futex: Handle early deadlock return correctly"), moved the remove_waiter() out of __rt_mutex_start_proxy_lock() (where 'ret' was only ever 0 or < 0) into the wrapper. Tighten this check to account for try_to_take_rt_mutex(). Fixes: 3bfdc63 ("rtmutex: Use waiter::task instead of current in remove_waiter()") Reported-by: syzbot+78147abe6c524f183ee9@syzkaller.appspotmail.com Signed-off-by: Davidlohr Bueso <dave@stgolabs.net> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Cc: stable@vger.kernel.org Closes: https://lore.kernel.org/all/69f114ac.050a0220.ac8b.0003.GAE@google.com/ Link: https://patch.msgid.link/20260507112913.1019537-1-dave@stgolabs.net (cherry picked from commit 40a25d5) Signed-off-by: Sultan Alsawaf <sultan@ciq.com>

github-actions · 2026-07-10T11:07:49Z

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/29088465788

github-actions · 2026-07-10T11:07:50Z

🔍 Upstream Linux Kernel Commit Check

⚠️ PR commit 6b6c3ce590dc (rtmutex: Use waiter::task instead of current in remove_waiter()) references upstream commit
3bfdc63936dd which has been referenced by a Fixes: tag in the upstream
Linux kernel:

    74e144274af3 futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Ji'an Zhou) (CVE-2026-53166)

This is an automated message from the kernel commit checker workflow.

github-actions · 2026-07-10T11:07:51Z

🔍 Interdiff Analysis

⚠️ PR commit 6b6c3ce590dc (rtmutex: Use waiter::task instead of current in remove_waiter()) → upstream 3bfdc63936dd
Differences found:

================================================================================
*    DELTA DIFFERENCES - code changes that differ between the patches          *
================================================================================

--- b/kernel/locking/rtmutex.c
+++ b/kernel/locking/rtmutex.c
@@ -1416,10 +1416,10 @@
 
 	lockdep_assert_held(&lock->wait_lock);
 
-	raw_spin_lock(&waiter_task->pi_lock);
-	rt_mutex_dequeue(lock, waiter);
-	waiter_task->pi_blocked_on = NULL;
-	raw_spin_unlock(&waiter_task->pi_lock);
+	scoped_guard(raw_spinlock, &waiter_task->pi_lock) {
+		rt_mutex_dequeue(lock, waiter);
+		waiter_task->pi_blocked_on = NULL;
+	}
 
 	/*
 	 * Only update priority if the waiter was the highest priority

⚠️ PR commit 485378eb6ba9 (locking/rtmutex: Skip remove_waiter() when waiter is not enqueued) → upstream 40a25d59e85b
Differences found:

################################################################################
!    REJECTED PATCH2 HUNKS - could not be compared; manual review needed       !
################################################################################

--- b/kernel/locking/rtmutex.c
+++ b/kernel/locking/rtmutex.c
@@ -1558,6 +1558,9 @@
 
 	lockdep_assert_held(&lock->wait_lock);
 
+	if (!waiter_task) /* never enqueued */
+		return;
+
 	scoped_guard(raw_spinlock, &waiter_task->pi_lock) {
 		rt_mutex_dequeue(lock, waiter);
 		waiter_task->pi_blocked_on = NULL;
--- b/kernel/locking/rtmutex_api.c
+++ b/kernel/locking/rtmutex_api.c
@@ -365,7 +365,7 @@
 
 	raw_spin_lock_irq(&lock->wait_lock);
 	ret = __rt_mutex_start_proxy_lock(lock, waiter, task, &wake_q);
-	if (unlikely(ret))
+	if (unlikely(ret < 0))
 		remove_waiter(lock, waiter);
 	preempt_disable();
 	raw_spin_unlock_irq(&lock->wait_lock);

================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/kernel/locking/rtmutex.c
+++ b/kernel/locking/rtmutex.c
@@ -1413,6 +1413,6 @@
 
 	lockdep_assert_held(&lock->wait_lock);
 
-	raw_spin_lock(&waiter_task->pi_lock);
-	rt_mutex_dequeue(lock, waiter);
-	waiter_task->pi_blocked_on = NULL;
+	scoped_guard(raw_spinlock, &waiter_task->pi_lock) {
+		rt_mutex_dequeue(lock, waiter);
+		waiter_task->pi_blocked_on = NULL;
--- b/kernel/locking/rtmutex_api.c
+++ b/kernel/locking/rtmutex_api.c
@@ -320,5 +320,6 @@
 	raw_spin_lock_irq(&lock->wait_lock);
-	ret = __rt_mutex_start_proxy_lock(lock, waiter, task);
+	ret = __rt_mutex_start_proxy_lock(lock, waiter, task, &wake_q);
 	if (unlikely(ret))
 		remove_waiter(lock, waiter);
+	preempt_disable();
 	raw_spin_unlock_irq(&lock->wait_lock);

This is an automated interdiff check for backported commits.

github-actions · 2026-07-10T11:09:01Z

JIRA PR Check Results

2 commit(s) with issues found:

Commit `485378eb6ba9`

Summary: locking/rtmutex: Skip remove_waiter() when waiter is not enqueued

❌ Errors:

VULN-190206: Status is 'To Do', expected 'In Progress'

⚠️ Warnings:

VULN-190206: No time logged - please log time manually

Commit `6b6c3ce590dc`

Summary: rtmutex: Use waiter::task instead of current in remove_waiter()

❌ Errors:

VULN-191593: Status is 'To Do', expected 'In Progress'

⚠️ Warnings:

VULN-191593: No time logged - please log time manually

Summary: Checked 2 commit(s) total.

github-actions · 2026-07-10T11:09:02Z

❌ Validation checks completed with issues View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/29088465788

bmastbergen · 2026-07-10T18:17:20Z

🔍 Upstream Linux Kernel Commit Check

⚠️ PR commit 6b6c3ce590dc (rtmutex: Use waiter::task instead of current in remove_waiter()) references upstream commit
3bfdc63936dd which has been referenced by a Fixes: tag in the upstream
Linux kernel:
    74e144274af3 futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Ji'an Zhou) (CVE-2026-53166)
This is an automated message from the kernel commit checker workflow.

We are not taking this because it just gets reverted later because it didn't fix the issue and introduced new ones:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=39def6d250d370298f86c116f4ac60093cefadaa

bmastbergen

🥌

Niebelungen-D and others added 2 commits July 9, 2026 19:49

ciq-kernel-automation Bot added the created-by-kernelci Tag PRs that were automatically created when a user branch was pushed to the repo (kernelCI) label Jul 10, 2026

bmastbergen approved these changes Jul 10, 2026

View reviewed changes

bmastbergen requested a review from a team July 10, 2026 18:17

kerneltoast mentioned this pull request Jul 11, 2026

[rlc-9/5.14.0-687.22.1.el9_8] rtmutex remove_waiter() fixes (2 commits) #1431

Open

kemotaha approved these changes Jul 11, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[ciqlts8_6] Multiple patches tested (2 commits)#1429

[ciqlts8_6] Multiple patches tested (2 commits)#1429
ciq-kernel-automation[bot] wants to merge 2 commits into
ciqlts8_6from
{sultan_futex}_ciqlts8_6

ciq-kernel-automation Bot commented Jul 10, 2026

Uh oh!

github-actions Bot commented Jul 10, 2026

Uh oh!

github-actions Bot commented Jul 10, 2026

Uh oh!

github-actions Bot commented Jul 10, 2026

Uh oh!

github-actions Bot commented Jul 10, 2026

Uh oh!

github-actions Bot commented Jul 10, 2026

Uh oh!

bmastbergen commented Jul 10, 2026

🔍 Upstream Linux Kernel Commit Check

Uh oh!

bmastbergen left a comment

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

ciq-kernel-automation Bot commented Jul 10, 2026

Summary

Commit Message(s)

Test Results

✅ Build Stage

✅ Boot Verification

✅ Kernel Selftests

✅ LTP Results

Uh oh!

github-actions Bot commented Jul 10, 2026

Uh oh!

github-actions Bot commented Jul 10, 2026

🔍 Upstream Linux Kernel Commit Check

Uh oh!

github-actions Bot commented Jul 10, 2026

🔍 Interdiff Analysis

Uh oh!

github-actions Bot commented Jul 10, 2026

JIRA PR Check Results

Commit 485378eb6ba9

Commit 6b6c3ce590dc

Uh oh!

github-actions Bot commented Jul 10, 2026

Uh oh!

bmastbergen commented Jul 10, 2026

🔍 Upstream Linux Kernel Commit Check

Uh oh!

bmastbergen left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

Commit `485378eb6ba9`

Commit `6b6c3ce590dc`