Re: [PATCH] locking/rwsem: Fix logic error in rwsem_del_waiter()

Peter Zijlstra
2026-03-16T11:52:02Z

On Sat, Mar 14, 2026 at 06:26:07PM +0000, Andrei Vagin wrote:
> Commit 1ea4b473504b ("locking/rwsem: Remove the list_head from struct
> rw_semaphore") introduced a logic error in rwsem_del_waiter().
>
> The root cause of this issue is an inconsistency in the return values of
> __rwsem_del_waiter() and rwsem_del_waiter(). Specifically,
> __rwsem_del_waiter() returns true when the wait list becomes empty,
> whereas rwsem_del_waiter() is supposed to return true if the wait list
> is NOT empty.
>
> This caused a null pointer dereference in rwsem_mark_wake() because it
> was being called when sem->first_waiter was NULL.
>
> Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
> Reported-by: syzbot+3d2ff92c67127d337463@syzkaller.appspotmail.com
> Tested-by: syzbot+3d2ff92c67127d337463@syzkaller.appspotmail.com
> Fixes: 1ea4b473504b ("locking/rwsem: Remove the list_head from struct rw_semaphore")
> Signed-off-by: Andrei Vagin <avagin@google.com>

Bah, indeed. Thanks!