From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 306EB362154; Thu, 2 Jul 2026 16:31:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783009874; cv=none; b=OjOirWyLItmUc3Yjt7KKXiejjpt+ZLeZq/lIPAuyB5ns+0Uw4YWdia2+hsfI57d0Opd6C7tnl6HkDdZOPYvyTJ1apjrWqI9q99Ky1WPZh+f6jE/Z7mo+rc5vbbKH+gflN+SMgB8N3Z8ohHiKffwtxFN+PbLb+N2GtBIDGfeVNBY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783009874; c=relaxed/simple; bh=vMeE0zNFjGxmb8C2fRKF10h6qaG6MeQUf9w6Z6e/sWU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=C3ZU77aaNQDWOUThTMrix3pEAOmwfSWbdPxwG+dfb+qI9n1gY2KDEDQs+E9xn/iGYV4r6Y1tScqKy/XhuI4MDdadKjlrHG0iTA+h01LSyeH7R8KY4k0m1TzzorW++kvSjJY92It6anpMzOIQ2v0sWKlj7UzWUsVuljtPuBMCmcY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=SM1YBWLM; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="SM1YBWLM" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 974901F000E9; Thu, 2 Jul 2026 16:31:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1783009873; bh=52tkHbPkagTI1vTuuNprsSPnC444dT7gzlRfHNGEbi8=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=SM1YBWLMpqx7N/6A9ZyKVWNMcu5jX4wotM8c9TQt7Z9nQTm+7l7owbVuW2fcLgF61 G+IhaiJlJtm+O8tCIZlrsAKB1sIKvpyH4wC7ZXdKt/SeSrLQArA4kCBeWlR/5iOmQ9 t8Z+zgUGddQEILRh6L04hS937WsDTIE4x4OT8K7Q= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, syzbot+b8ca586b9fc235f0c0df@syzkaller.appspotmail.com, Helen Koike , Thomas Gleixner , Sasha Levin Subject: [PATCH 6.1 025/129] debugobjects: Do not fill_pool() if pi_blocked_on Date: Thu, 2 Jul 2026 18:19:04 +0200 Message-ID: <20260702155112.681449840@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260702155112.163984240@linuxfoundation.org> References: <20260702155112.163984240@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.1-stable review patch. If anyone has any objections, please let me know. ------------------ From: Helen Koike commit 5f41161059fd0f1bbf18c90f3180e38cc45a14eb upstream. On RT enabled kernels, fill_pool() ends up calling rtlock_lock(), which asserts if current::pi_blocked_on is set, because a task can obviously only block on one lock as otherwise the priority inheritenace chain gets corrupted. Prevent this by expanding the conditional to take current::pi_blocked_on into account. Fixes: 4bedcc28469a ("debugobjects: Make them PREEMPT_RT aware") Reported-by: syzbot+b8ca586b9fc235f0c0df@syzkaller.appspotmail.com Signed-off-by: Helen Koike Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260511215359.3351259-1-koike@igalia.com Closes: https://syzkaller.appspot.com/bug?extid=b8ca586b9fc235f0c0df Signed-off-by: Sasha Levin --- lib/debugobjects.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/lib/debugobjects.c b/lib/debugobjects.c index a7f3c6f15125a9..5e653e2ffa8dac 100644 --- a/lib/debugobjects.c +++ b/lib/debugobjects.c @@ -597,15 +597,25 @@ static struct debug_obj *lookup_object_or_alloc(void *addr, struct debug_bucket return NULL; } +static inline bool debug_objects_is_pi_blocked_on(void) +{ +#ifdef CONFIG_RT_MUTEXES + return current->pi_blocked_on != NULL; +#else + return false; +#endif +} + static void debug_objects_fill_pool(void) { /* * On RT enabled kernels the pool refill must happen in preemptible - * context -- for !RT kernels we rely on the fact that spinlock_t and - * raw_spinlock_t are basically the same type and this lock-type - * inversion works just fine. + * context and not enqueued on an rt_mutex -- for !RT kernels we rely + * on the fact that spinlock_t and raw_spinlock_t are basically the + * same type and this lock-type inversion works just fine. */ - if (!IS_ENABLED(CONFIG_PREEMPT_RT) || preemptible() || system_state < SYSTEM_SCHEDULING) { + if (!IS_ENABLED(CONFIG_PREEMPT_RT) || system_state < SYSTEM_SCHEDULING || + (preemptible() && !debug_objects_is_pi_blocked_on())) { /* * Annotate away the spinlock_t inside raw_spinlock_t warning * by temporarily raising the wait-type to LD_WAIT_CONFIG, matching -- 2.53.0