Skip to content

[ciq-6.18.y] Multiple patches tested (2 commits)#1433

Open
ciq-kernel-automation[bot] wants to merge 2 commits into
ciq-6.18.yfrom
{bmastbergen}_ciq-6.18.y
Open

[ciq-6.18.y] Multiple patches tested (2 commits)#1433
ciq-kernel-automation[bot] wants to merge 2 commits into
ciq-6.18.yfrom
{bmastbergen}_ciq-6.18.y

Conversation

@ciq-kernel-automation

Copy link
Copy Markdown

Summary

This PR has been automatically created after successful completion of all CI stages.

Commit Message(s)

futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock""

cve-bf CVE-2026-53166
commit-author Sebastian Andrzej Siewior <bigeasy@linutronix.de>
commit 39def6d250d370298f86c116f4ac60093cefadaa
[CIQ] ciq_kernel-6.18.38-2 - updated spec

Test Results

✅ Build Stage

Architecture Build Time Total Time
x86_64 37m 20s 38m 8s
aarch64 23m 18s 23m 51s

✅ Boot Verification

✅ Kernel Selftests

Architecture Passed Failed Compared Against Status
x86_64 442 65 ciq-6.18.y ⚠️ No baseline available
aarch64 374 57 ciq-6.18.y ⚠️ No baseline available

✅ LTP Results

Architecture Passed Failed Compared Against Status
x86_64 1479 81 ciq-6.18.y ⚠️ No baseline available
aarch64 1454 82 ciq-6.18.y ⚠️ No baseline available

🤖 This PR was automatically generated by GitHub Actions
Run ID: 29110179767

…ter() on self-deadlock""

cve-bf CVE-2026-53166
commit-author Sebastian Andrzej Siewior <bigeasy@linutronix.de>
commit 39def6d

The commit cited below should not have been merged. It attemted to fix an
existing problem ansd thereby introduced new problems by keeping the
pi_state in state Q_REQUEUE_PI_IN_PROGRESS and leaking it.

Based on the commit description the intention was to handle the case
when task_blocks_on_rt_mutex() returns -EDEADLK and the following
remove_waiter() dereferences the NULL pointer in waiter->task.

That is already handled by Davidlohr in commit 40a25d5
("locking/rtmutex: Skip remove_waiter() when waiter is not enqueued") and
requires no further acting.

Revert the commit breaking the "waiter == owner" case again.

Fixes: 74e1442 ("futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock")
	Reported-by: Michael Bommarito <michael.bommarito@gmail.com>
	Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
	Signed-off-by: Thomas Gleixner <tglx@kernel.org>
	Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260701131150.0Ijhq4Dw@linutronix.de
Closes: https://lore.kernel.org/all/20260629020049.2082397-1-michael.bommarito@gmail.com
(cherry picked from commit 39def6d)
	Signed-off-by: Brett Mastbergen <bmastbergen@ciq.com>
@ciq-kernel-automation ciq-kernel-automation Bot added the created-by-kernelci Tag PRs that were automatically created when a user branch was pushed to the repo (kernelCI) label Jul 11, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

created-by-kernelci Tag PRs that were automatically created when a user branch was pushed to the repo (kernelCI)

Development

Successfully merging this pull request may close these issues.

1 participant