linux-kernel - [PATCH] locking/mutex:add MUTEX_CHCEK_INIT to detect uninitialized mutex lock

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20250924022500.2577-1-buckzhang1212@yeah.net>
Date: Tue, 23 Sep 2025 19:25:00 -0700
From: buckzhang1212@...h.net
To: Peter Zijlstra <peterz@...radead.org>,
	Ingo Molnar <mingo@...hat.com>,
	Will Deacon <will@...nel.org>,
	Boqun Feng <boqun.feng@...il.com>,
	Waiman Long <longman@...hat.com>,
	linux-kernel@...r.kernel.org
Cc: buckzhang1212@...h.net
Subject: [PATCH] locking/mutex:add MUTEX_CHCEK_INIT to detect uninitialized mutex lock

From: "buck.zhang" <buckzhang1212@...h.net>

Here is a kernel exception about mutex and I can recreate it stably.
First we define a custome struct that includes a mutex lock.
Then allocate this struct by kmalloc without calling mutex_init.
Finally when multiple tasks call mutex_lock together,kernel will panic.
But Kernel is good  if only one task call this mutex at the same time.
the exception reason is that lock->wait_list is an invalid kernel list.
kernel crash log: 
Unable to handle kernel NULL pointer dereference at virtual address 0000000
pc: __mutex_add_waiter+0x68/0x160
lr: __mutex_add_waiter+0x128/0x160
sp: ffffffc0866f3ac0
x29: ffffffc0866f3ad0 x28: ffffff8095148000 x27: 0000000000000000
x2: ffffffc0866f3b18 x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
__mutex_add_waiter+0x68/0x160
__mutex_lock+0x48c/0x119c
__mutex_lock_slowpath+0x1c/0x2c
mutex_lock+0x48/0x144
Test case:
struct chip_mutex {
	struct mutex tmutex;
};
static void work_handler1(struct chip_mutex *cmutex)
{
        mutex_lock(&(cmutex->tmutex));
}
static void work_handler2(struct chip_mutex *cmutex)
{
         mutex_lock(&(cmutex->tmutex));
}
static void chip_tmutex(void)
{
	struct chip_mutex *cmutex;
	cmutex = kzalloc(sizeof(struct chip_mutex),GFP_KERNEL);
	work_handler1(cmutex);
	------
	work_handler2(cmutex);
}

Signed-off-by: buck.zhang <buckzhang1212@...h.net>
---
 kernel/locking/mutex.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/kernel/locking/mutex.c b/kernel/locking/mutex.c
index de7d6702c..8fbe858c8 100644
--- a/kernel/locking/mutex.c
+++ b/kernel/locking/mutex.c
@@ -42,6 +42,16 @@
 #else
 # define MUTEX_WARN_ON(cond)
 #endif
+#define MUTEX_CHCEK_INIT(lock)  mutex_check_waitlist(lock)
+static void mutex_check_waitlist(struct mutex *lock)
+{
+	struct list_head *list = &lock->wait_list;
+
+	if ((unsigned long)list->next < PAGE_OFFSET) {
+		pr_err("BUG: mutex lock is uninitialized，wait_list is Error\n");
+		MUTEX_WARN_ON("mutex lock is uninitialized");
+	}
+}
 
 void
 __mutex_init(struct mutex *lock, const char *name, struct lock_class_key *key)
@@ -269,6 +279,7 @@ static void __sched __mutex_lock_slowpath(struct mutex *lock);
 void __sched mutex_lock(struct mutex *lock)
 {
 	might_sleep();
+	MUTEX_CHCEK_INIT(lock);
 
 	if (!__mutex_trylock_fast(lock))
 		__mutex_lock_slowpath(lock);
@@ -991,6 +1002,7 @@ __mutex_lock_interruptible_slowpath(struct mutex *lock);
 int __sched mutex_lock_interruptible(struct mutex *lock)
 {
 	might_sleep();
+	MUTEX_CHCEK_INIT(lock);
 
 	if (__mutex_trylock_fast(lock))
 		return 0;
@@ -1015,6 +1027,7 @@ EXPORT_SYMBOL(mutex_lock_interruptible);
 int __sched mutex_lock_killable(struct mutex *lock)
 {
 	might_sleep();
+	MUTEX_CHCEK_INIT(lock);
 
 	if (__mutex_trylock_fast(lock))
 		return 0;
-- 
2.17.1