linux-kernel - Re: [PATCH] locking/mutex:add MUTEX_CHCEK_INIT to detect uninitialized mutex lock

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <dbba6b72-d270-4b7e-bb21-39ac8a46864a@redhat.com>
Date: Tue, 23 Sep 2025 23:10:22 -0400
From: Waiman Long <llong@...hat.com>
To: buckzhang1212@...h.net, Peter Zijlstra <peterz@...radead.org>,
 Ingo Molnar <mingo@...hat.com>, Will Deacon <will@...nel.org>,
 Boqun Feng <boqun.feng@...il.com>, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] locking/mutex:add MUTEX_CHCEK_INIT to detect
 uninitialized mutex lock

On 9/23/25 10:25 PM, buckzhang1212@...h.net wrote:
> From: "buck.zhang" <buckzhang1212@...h.net>
>
> Here is a kernel exception about mutex and I can recreate it stably.
> First we define a custome struct that includes a mutex lock.
> Then allocate this struct by kmalloc without calling mutex_init.
> Finally when multiple tasks call mutex_lock together,kernel will panic.
> But Kernel is good  if only one task call this mutex at the same time.
> the exception reason is that lock->wait_list is an invalid kernel list.
> kernel crash log:
> Unable to handle kernel NULL pointer dereference at virtual address 0000000
> pc: __mutex_add_waiter+0x68/0x160
> lr: __mutex_add_waiter+0x128/0x160
> sp: ffffffc0866f3ac0
> x29: ffffffc0866f3ad0 x28: ffffff8095148000 x27: 0000000000000000
> x2: ffffffc0866f3b18 x1 : 0000000000000000 x0 : 0000000000000000
> Call trace:
> __mutex_add_waiter+0x68/0x160
> __mutex_lock+0x48c/0x119c
> __mutex_lock_slowpath+0x1c/0x2c
> mutex_lock+0x48/0x144
> Test case:
> struct chip_mutex {
> 	struct mutex tmutex;
> };
> static void work_handler1(struct chip_mutex *cmutex)
> {
>          mutex_lock(&(cmutex->tmutex));
> }
> static void work_handler2(struct chip_mutex *cmutex)
> {
>           mutex_lock(&(cmutex->tmutex));
> }
> static void chip_tmutex(void)
> {
> 	struct chip_mutex *cmutex;
> 	cmutex = kzalloc(sizeof(struct chip_mutex),GFP_KERNEL);
> 	work_handler1(cmutex);
> 	------
> 	work_handler2(cmutex);
> }
>
> Signed-off-by: buck.zhang <buckzhang1212@...h.net>
A mutex must be properly initialized before it can be used. The kernel 
panic you listed above is expected and the panic itself indicates that 
the code is wrong.
> ---
>   kernel/locking/mutex.c | 12 ++++++++++++
>   1 file changed, 12 insertions(+)
>
> diff --git a/kernel/locking/mutex.c b/kernel/locking/mutex.c
> index de7d6702c..8fbe858c8 100644
> --- a/kernel/locking/mutex.c
> +++ b/kernel/locking/mutex.c
> @@ -42,6 +42,16 @@
>   #else
>   # define MUTEX_WARN_ON(cond)
>   #endif
> +#define MUTEX_CHCEK_INIT(lock)  mutex_check_waitlist(lock)
> +static void mutex_check_waitlist(struct mutex *lock)
> +{
> +	struct list_head *list = &lock->wait_list;
> +
> +	if ((unsigned long)list->next < PAGE_OFFSET) {
> +		pr_err("BUG: mutex lock is uninitialized，wait_list is Error\n");
> +		MUTEX_WARN_ON("mutex lock is uninitialized");
> +	}
> +}
>   
>   void
>   __mutex_init(struct mutex *lock, const char *name, struct lock_class_key *key)
> @@ -269,6 +279,7 @@ static void __sched __mutex_lock_slowpath(struct mutex *lock);
>   void __sched mutex_lock(struct mutex *lock)
>   {
>   	might_sleep();
> +	MUTEX_CHCEK_INIT(lock);
>   
>   	if (!__mutex_trylock_fast(lock))
>   		__mutex_lock_slowpath(lock);

This check has provided no additional value and it slows down the 
locking fast path.

NACK

> @@ -991,6 +1002,7 @@ __mutex_lock_interruptible_slowpath(struct mutex *lock);
>   int __sched mutex_lock_interruptible(struct mutex *lock)
>   {
>   	might_sleep();
> +	MUTEX_CHCEK_INIT(lock);
>   
>   	if (__mutex_trylock_fast(lock))
>   		return 0;
> @@ -1015,6 +1027,7 @@ EXPORT_SYMBOL(mutex_lock_interruptible);
>   int __sched mutex_lock_killable(struct mutex *lock)
>   {
>   	might_sleep();
> +	MUTEX_CHCEK_INIT(lock);
>   
>   	if (__mutex_trylock_fast(lock))
>   		return 0;