Re: [PATCH] locking/rwsem: Fix logic error in rwsem_del_waiter()

[Peter Zijlstra]

On Sat, Mar 14, 2026 at 06:26:07PM +0000, Andrei Vagin wrote:
> Commit 1ea4b473504b ("locking/rwsem: Remove the list_head from struct
> rw_semaphore") introduced a logic error in rwsem_del_waiter().
> 
> The root cause of this issue is an inconsistency in the return values of
> __rwsem_del_waiter() and rwsem_del_waiter(). Specifically,
> __rwsem_del_waiter() returns true when the wait list becomes empty,
> whereas rwsem_del_waiter() is supposed to return true if the wait list
> is NOT empty.
> 
> This caused a null pointer dereference in rwsem_mark_wake() because it
> was being called when sem->first_waiter was NULL.
> 
> Cc: Matthew Wilcox (Oracle) <willy@xxxxxxxxxxxxx>
> Reported-by: syzbot+3d2ff92c67127d337463@xxxxxxxxxxxxxxxxxxxxxxxxx
> Tested-by: syzbot+3d2ff92c67127d337463@xxxxxxxxxxxxxxxxxxxxxxxxx
> Fixes: 1ea4b473504b ("locking/rwsem: Remove the list_head from struct rw_semaphore")
> Signed-off-by: Andrei Vagin <avagin@xxxxxxxxxx>

Bah, indeed. Thanks!