Commit 892c894b authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'locking-urgent-2026-04-24' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 

Pull locking fixes from Ingo Molnar:

 - Fix ww_mutex regression, which caused hangs/pauses in some DRM drivers

 - Fix rtmutex proxy-rollback bug

* tag 'locking-urgent-2026-04-24' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  locking/mutex: Fix ww_mutex wait_list operations
  rtmutex: Use waiter::task instead of current in remove_waiter()
parents 8f4e8687 0adc92b9

kernel/locking/mutex.c

+27 −13
Original line number Diff line number Diff line
@@ -198,28 +198,44 @@ static inline void __mutex_clear_flag(struct mutex *lock, unsigned long flag) 
}



/*

 * Add @waiter to a given location in the lock wait_list and set the

 * FLAG_WAITERS flag if it's the first waiter.

 * Add @waiter to the @lock wait_list and set the FLAG_WAITERS flag if it's

 * the first waiter.

 *

 * When @pos, @waiter is added before the waiter indicated by @pos. Otherwise

 * @waiter will be added to the tail of the list.

 */

static void

__mutex_add_waiter(struct mutex *lock, struct mutex_waiter *waiter,

		   struct mutex_waiter *first)

		   struct mutex_waiter *pos)

	__must_hold(&lock->wait_lock)

{

	struct mutex_waiter *first = lock->first_waiter;



	hung_task_set_blocker(lock, BLOCKER_TYPE_MUTEX);

	debug_mutex_add_waiter(lock, waiter, current);



	if (!first)

		first = lock->first_waiter;

	if (pos) {

		/*

		 * Insert @waiter before @pos.

		 */

		list_add_tail(&waiter->list, &pos->list);

		/*

		 * If @pos == @first, then @waiter will be the new first.

		 */

		if (pos == first)

			lock->first_waiter = waiter;

		return;

	}



	if (first) {

		list_add_tail(&waiter->list, &first->list);

	} else {

		return;

	}



	INIT_LIST_HEAD(&waiter->list);

	lock->first_waiter = waiter;

	__mutex_set_flag(lock, MUTEX_FLAG_WAITERS);

}

}



static void

__mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter)
@@ -229,10 +245,8 @@ __mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter) 
		__mutex_clear_flag(lock, MUTEX_FLAGS);

		lock->first_waiter = NULL;

	} else {

		if (lock->first_waiter == waiter) {

			lock->first_waiter = list_first_entry(&waiter->list,

							      struct mutex_waiter, list);

		}

		if (lock->first_waiter == waiter)

			lock->first_waiter = list_next_entry(waiter, list);

		list_del(&waiter->list);

	}

kernel/locking/rtmutex.c

+8 −5
Original line number Diff line number Diff line
@@ -1544,6 +1544,8 @@ static bool rtmutex_spin_on_owner(struct rt_mutex_base *lock, 
 *

 * Must be called with lock->wait_lock held and interrupts disabled. It must

 * have just failed to try_to_take_rt_mutex().

 *

 * When invoked from rt_mutex_start_proxy_lock() waiter::task != current !

 */

static void __sched remove_waiter(struct rt_mutex_base *lock,

				  struct rt_mutex_waiter *waiter)
@@ -1551,14 +1553,15 @@ static void __sched remove_waiter(struct rt_mutex_base *lock, 
{

	bool is_top_waiter = (waiter == rt_mutex_top_waiter(lock));

	struct task_struct *owner = rt_mutex_owner(lock);

	struct task_struct *waiter_task = waiter->task;

	struct rt_mutex_base *next_lock;



	lockdep_assert_held(&lock->wait_lock);



	raw_spin_lock(&current->pi_lock);

	scoped_guard(raw_spinlock, &waiter_task->pi_lock) {

		rt_mutex_dequeue(lock, waiter);

	current->pi_blocked_on = NULL;

	raw_spin_unlock(&current->pi_lock);

		waiter_task->pi_blocked_on = NULL;

	}



	/*

	 * Only update priority if the waiter was the highest priority
@@ -1594,7 +1597,7 @@ static void __sched remove_waiter(struct rt_mutex_base *lock, 
	raw_spin_unlock_irq(&lock->wait_lock);



	rt_mutex_adjust_prio_chain(owner, RT_MUTEX_MIN_CHAINWALK, lock,

				   next_lock, NULL, current);

				   next_lock, NULL, waiter_task);



	raw_spin_lock_irq(&lock->wait_lock);

}

kernel/locking/ww_mutex.h

+32 −2
Original line number Diff line number Diff line
@@ -6,6 +6,19 @@ 
#define MUTEX_WAITER	mutex_waiter

#define WAIT_LOCK	wait_lock



/*

 *           +--------+

 *           | first  |

 *           +--------+

 *                |

 *                v

 *  +----+     +----+     +----+

 *  | W3 | <-> | W1 | <-> | W2 |

 *  +----+     +----+     +----+

 *    ^                     ^

 *    +---------------------+

 */



static inline struct mutex_waiter *

__ww_waiter_first(struct mutex *lock)

	__must_hold(&lock->wait_lock)
@@ -13,26 +26,43 @@ __ww_waiter_first(struct mutex *lock) 
	return lock->first_waiter;

}



/*

 * for (cur = __ww_waiter_first(); cur; cur = __ww_waiter_next())

 *

 * Should iterate like: W1, W2, W3

 */

static inline struct mutex_waiter *

__ww_waiter_next(struct mutex *lock, struct mutex_waiter *w)

	__must_hold(&lock->wait_lock)

{

	w = list_next_entry(w, list);

	/*

	 * Terminate if the next entry is the first again, that has already

	 * been observed.

	 */

	if (lock->first_waiter == w)

		return NULL;



	return w;

}



/*

 * for (cur = __ww_waiter_last(); cur; cur = __ww_waiter_prev())

 *

 * Should iterate like: W3, W2, W1

 */

static inline struct mutex_waiter *

__ww_waiter_prev(struct mutex *lock, struct mutex_waiter *w)

	__must_hold(&lock->wait_lock)

{

	w = list_prev_entry(w, list);

	/*

	 * Terminate at the first entry, the previous entry of first is the

	 * last and that has already been observed.

	 */

	if (lock->first_waiter == w)

		return NULL;



	return w;

	return list_prev_entry(w, list);

}



static inline struct mutex_waiter *