[PATCH] locking/rwsem: Fix logic error in rwsem_del_waiter()

Andrei Vagin
2026-03-14T18:26:18Z

Commit 1ea4b473504b ("locking/rwsem: Remove the list_head from struct
rw_semaphore") introduced a logic error in rwsem_del_waiter().

The root cause of this issue is an inconsistency in the return values of
__rwsem_del_waiter() and rwsem_del_waiter(). Specifically,
__rwsem_del_waiter() returns true when the wait list becomes empty,
whereas rwsem_del_waiter() is supposed to return true if the wait list
is NOT empty.

This caused a null pointer dereference in rwsem_mark_wake() because it
was being called when sem->first_waiter was NULL.

Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Reported-by: syzbot+3d2ff92c67127d337463@syzkaller.appspotmail.com
Tested-by: syzbot+3d2ff92c67127d337463@syzkaller.appspotmail.com
Fixes: 1ea4b473504b ("locking/rwsem: Remove the list_head from struct rw_semaphore")
Signed-off-by: Andrei Vagin <avagin@google.com>
---
kernel/locking/rwsem.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/kernel/locking/rwsem.c b/kernel/locking/rwsem.c
index ba4cb74de064..bf647097369c 100644
--- a/kernel/locking/rwsem.c
+++ b/kernel/locking/rwsem.c
@@ -370,7 +370,7 @@ bool __rwsem_del_waiter(struct rw_semaphore *sem, struct rwsem_waiter *waiter)
{
if (list_empty(&waiter->list)) {
sem->first_waiter = NULL;
- return true;
+ return false;
}

if (sem->first_waiter == waiter) {
@@ -379,7 +379,7 @@ bool __rwsem_del_waiter(struct rw_semaphore *sem, struct rwsem_waiter *waiter)
}
list_del(&waiter->list);

- return false;
+ return true;
}

/*
--
2.53.0.851.ga537e3e6e9-goog