Description
In the Linux kernel, the following vulnerability has been resolved: futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock When FUTEX_CMP_REQUEUE_PI requeues a non-top waiter that already owns the target PI futex, task_blocks_on_rt_mutex() returns -EDEADLK before setting waiter->task. The subsequent remove_waiter() in rt_mutex_start_proxy_lock() dereferences the NULL waiter->task, causing a kernel crash. Add a self-deadlock check for non-top waiters before calling rt_mutex_start_proxy_lock(), analogous to the top-waiter check in futex_lock_pi_atomic().
Affected products
- Linux / Linux3fb7394a837740770f0d6b4b30567e60786a63f2 – 16f8e17184b31382076f84751db5ac51fc02733e
- Linux / Linux88614876370aac8ad1050ad785a4c095ba17ac11 – 1f2f3f3eacd6653ab215c5d2ea70811148d433fc
- Linux / Linux3bfdc63936dd4773109b7b8c280c0f3b5ae7d349 – 74e144274af39935b0f410c0ee4d2b91c3730414
- Linux / Linuxd8cce4773c2b23d819baf5abedc62f7b430e8745 – d8cce4773c2b23d819baf5abedc62f7b430e8745
- Linux / Linux8a1fc8d698ac5e5916e3082a0f74450d71f9611f – 8a1fc8d698ac5e5916e3082a0f74450d71f9611f
- Linux / Linux6d52dfcb2a5db86e346cf51f8fcf2071b8085166 – 6d52dfcb2a5db86e346cf51f8fcf2071b8085166
- Linux / Linux6.1.175 – 6.2
- Linux / Linux6.6.140 – 6.7
- Linux / Linux6.12.86 – 6.13
- Linux / Linux6.18.27 – 6.18.36
- Linux / Linux7.0.4 – 7.0.13