linux-kernel - Re: [PATCH] locking/mutex: add MUTEX_WARN

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <f6b88959-aed3-423f-a12d-46bb679820e1@redhat.com>
Date: Sun, 28 Sep 2025 11:55:22 -0400
From: Waiman Long <llong@...hat.com>
To: buckzhang1212@...h.net, Peter Zijlstra <peterz@...radead.org>,
 Ingo Molnar <mingo@...hat.com>, Will Deacon <will@...nel.org>,
 Boqun Feng <boqun.feng@...il.com>, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] locking/mutex: add MUTEX_WARN_ON to warn invalid mutex

On 9/27/25 4:00 AM, buckzhang1212@...h.net wrote:
> From: "buck.zhang" <buckzhang1212@...h.net>
>
> Here is a kernel exception about mutex and I can recreate it stably.
> First we define a struct contains a mutex.
> Then allocate this struct by kmalloc without calling mutex_init.
> Finally when multiple tasks call mutex_lock together,kernel will panic.
> This lock is used normally when only one task is using  at a time.
> the exception reason is that lock->wait_list is an invalid kernel list.
> I want to add more warnings when enable CONFIG_DEBUG_MUTEXES
> kernel crash log:
> Unable to handle kernel NULL pointer dereference at virtual address 0000000
> pc: __mutex_add_waiter+0x68/0x160
> lr: __mutex_add_waiter+0x128/0x160
> sp: ffffffc0866f3ac0
> x29: ffffffc0866f3ad0 x28: ffffff8095148000 x27: 0000000000000000
> .............
> x2: ffffffc0866f3b18 x1 : 0000000000000000 x0 : 0000000000000000
> Call trace:
> __mutex_add_waiter+0x68/0x160
> __mutex_lock+0x48c/0x119c
> __mutex_lock_slowpath+0x1c/0x2c
> mutex_lock+0x48/0x144
> Test case:
> struct chip_mutex {
> 	struct mutex tmutex;
> };
> static void work_handler1(struct chip_mutex *cmutex)
> {
>          mutex_lock(&(cmutex->tmutex));
> }
> static void work_handler2(struct chip_mutex *cmutex)
> {
>           mutex_lock(&(cmutex->tmutex));
> }
> static void chip_tmutex(void)
> {
> 	struct chip_mutex *cmutex;
> 	cmutex = kzalloc(sizeof(struct chip_mutex),GFP_KERNEL);
> 	work_handler1(cmutex);
> 	------
> 	work_handler2(cmutex);
> }
>
> Signed-off-by: buck.zhang <buckzhang1212@...h.net>
> ---
>   kernel/locking/mutex.c |  2 ++
>   kernel/locking/mutex.h | 11 +++++++++++
>   2 files changed, 13 insertions(+)
>
> diff --git a/kernel/locking/mutex.c b/kernel/locking/mutex.c
> index de7d6702c..318d98f2f 100644
> --- a/kernel/locking/mutex.c
> +++ b/kernel/locking/mutex.c
> @@ -574,6 +574,8 @@ __mutex_lock_common(struct mutex *lock, unsigned int state, unsigned int subclas
>   
>   	might_sleep();
>   
> +	/* In case the mutex is uninitiated, add more warning */
> +	MUTEX_WARN_ON(mutex_waitlist_invalid(&lock->wait_list));
>   	MUTEX_WARN_ON(lock->magic != lock);

By enabling CONFIG_DEBUG_MUTEXES, the lock->magic check should have 
uncovered the case of mutex_lock() call without mutex initialization. 
The extra wait_list check is likely not necessary.

Cheers,
Longman