[SRU][N:linux-hwe-6.17][PATCH 2/2] locking/rtmutex: Skip remove_waiter() when waiter is not enqueued

[Fedor Veselovskii]

From: Davidlohr Bueso <dave at stgolabs.net>

remove_waiter() can be reached after proxy-lock setup reports an error
before the waiter has been associated with a task. In that case
waiter->task is NULL and there is no enqueued waiter to remove.

Also, rt_mutex_start_proxy_lock() returns a positive value when the
proxy task acquires the lock immediately. That is a successful
acquisition, so cleanup through remove_waiter() is required only for
negative return values.

Fixes: 3bfdc63936dd ("rtmutex: Use waiter::task instead of current in remove_waiter()")
Reported-by: syzbot+78147abe6c524f183ee9 at syzkaller.appspotmail.com
Signed-off-by: Davidlohr Bueso <dave at stgolabs.net>
Signed-off-by: Thomas Gleixner <tglx at kernel.org>
Cc: stable at vger.kernel.org
Closes: https://lore.kernel.org/all/69f114ac.050a0220.ac8b.0003.GAE@google.com/
Link: https://patch.msgid.link/20260507112913.1019537-1-dave@stgolabs.net

(backported from commit 40a25d59e85b3c8709ac2424d44f65610467871e)
[Fedor Veselovskii: Applied the upstream changes manually to Ubuntu
6.17. The wake_q-enabled rt_mutex_start_proxy_lock() layout already
matched the upstream implementation; no semantic changes were made.]
Assisted-by: ChatGPT:GPT-5.6 Thinking
CVE-2026-53163
Signed-off-by: Fedor Veselovskii <asetium at gmail.com>
---
 kernel/locking/rtmutex.c     | 3 +++
 kernel/locking/rtmutex_api.c | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c
index e6c6dd086..fb6748243 100644
--- a/kernel/locking/rtmutex.c
+++ b/kernel/locking/rtmutex.c
@@ -1548,6 +1548,9 @@ static void __sched remove_waiter(struct rt_mutex_base *lock,
 
 	lockdep_assert_held(&lock->wait_lock);
 
+	if (!waiter_task) /* never enqueued */
+		return;
+
 	scoped_guard(raw_spinlock, &waiter_task->pi_lock) {
 		rt_mutex_dequeue(lock, waiter);
 		waiter_task->pi_blocked_on = NULL;
diff --git a/kernel/locking/rtmutex_api.c b/kernel/locking/rtmutex_api.c
index bafd5af98..73af81b99 100644
--- a/kernel/locking/rtmutex_api.c
+++ b/kernel/locking/rtmutex_api.c
@@ -365,7 +365,7 @@ int __sched rt_mutex_start_proxy_lock(struct rt_mutex_base *lock,
 
 	raw_spin_lock_irq(&lock->wait_lock);
 	ret = __rt_mutex_start_proxy_lock(lock, waiter, task, &wake_q);
-	if (unlikely(ret))
+	if (unlikely(ret < 0))
 		remove_waiter(lock, waiter);
 	preempt_disable();
 	raw_spin_unlock_irq(&lock->wait_lock);
-- 
2.43.0