diff options
| author | Yunhui Cui <cuiyunhui@bytedance.com> | 2025-01-26 11:32:43 +0800 |
|---|---|---|
| committer | Peter Zijlstra <peterz@infradead.org> | 2025-02-21 20:19:12 +0100 |
| commit | 337369f8ce9e20226402cf139c4f0d3ada7d1705 (patch) | |
| tree | 5f9bcd8033065b5b3d21076287d2366d23d6b497 /kernel/locking | |
| parent | 2d352ec9fcb5d965318e7855b2406a7a14e9ae13 (diff) | |
locking/mutex: Add MUTEX_WARN_ON() into fast path
Scenario: In platform_device_register, the driver misuses struct
device as platform_data, making kmemdup duplicate a device. Accessing
the duplicate may cause list corruption due to its mutex magic or list
holding old content.
It recurs randomly as the first mutex - getting process skips the slow
path and mutex check. Adding MUTEX_WARN_ON(lock->magic!= lock) in
__mutex_trylock_fast() makes it always happen.
Signed-off-by: Yunhui Cui <cuiyunhui@bytedance.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20250126033243.53069-1-cuiyunhui@bytedance.com
Diffstat (limited to 'kernel/locking')
| -rw-r--r-- | kernel/locking/mutex.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/kernel/locking/mutex.c b/kernel/locking/mutex.c index b36f23de48f1..19b636f60a24 100644 --- a/kernel/locking/mutex.c +++ b/kernel/locking/mutex.c @@ -143,6 +143,8 @@ static __always_inline bool __mutex_trylock_fast(struct mutex *lock) unsigned long curr = (unsigned long)current; unsigned long zero = 0UL; + MUTEX_WARN_ON(lock->magic != lock); + if (atomic_long_try_cmpxchg_acquire(&lock->owner, &zero, curr)) return true; |