[tip: locking/core] locking/rwsem: Fix logic error in rwsem_del_waiter()

[tip-bot2 for Andrei Vagin]

The following commit has been merged into the locking/core branch of tip:

Commit-ID:     68bcd8b6e0b10d902f7fc8bf3f08f335f5d1640e
Gitweb:        https://git.kernel.org/tip/68bcd8b6e0b10d902f7fc8bf3f08f335f5d1640e
Author:        Andrei Vagin <avagin@xxxxxxxxxx>
AuthorDate:    Sat, 14 Mar 2026 18:26:07 
Committer:     Peter Zijlstra <peterz@xxxxxxxxxxxxx>
CommitterDate: Mon, 16 Mar 2026 13:16:48 +01:00

locking/rwsem: Fix logic error in rwsem_del_waiter()

Commit 1ea4b473504b ("locking/rwsem: Remove the list_head from struct
rw_semaphore") introduced a logic error in rwsem_del_waiter().

The root cause of this issue is an inconsistency in the return values of
__rwsem_del_waiter() and rwsem_del_waiter(). Specifically,
__rwsem_del_waiter() returns true when the wait list becomes empty,
whereas rwsem_del_waiter() is supposed to return true if the wait list
is NOT empty.

This caused a null pointer dereference in rwsem_mark_wake() because it
was being called when sem->first_waiter was NULL.

Fixes: 1ea4b473504b ("locking/rwsem: Remove the list_head from struct rw_semaphore")
Reported-by: syzbot+3d2ff92c67127d337463@xxxxxxxxxxxxxxxxxxxxxxxxx
Signed-off-by: Andrei Vagin <avagin@xxxxxxxxxx>
Signed-off-by: Peter Zijlstra (Intel) <peterz@xxxxxxxxxxxxx>
Tested-by: syzbot+3d2ff92c67127d337463@xxxxxxxxxxxxxxxxxxxxxxxxx
Link: https://patch.msgid.link/20260314182607.3343346-1-avagin@xxxxxxxxxx
---
 kernel/locking/rwsem.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/kernel/locking/rwsem.c b/kernel/locking/rwsem.c
index ba4cb74..bf64709 100644
--- a/kernel/locking/rwsem.c
+++ b/kernel/locking/rwsem.c
@@ -370,7 +370,7 @@ bool __rwsem_del_waiter(struct rw_semaphore *sem, struct rwsem_waiter *waiter)
 {
 	if (list_empty(&waiter->list)) {
 		sem->first_waiter = NULL;
-		return true;
+		return false;
 	}
 
 	if (sem->first_waiter == waiter) {
@@ -379,7 +379,7 @@ bool __rwsem_del_waiter(struct rw_semaphore *sem, struct rwsem_waiter *waiter)
 	}
 	list_del(&waiter->list);
 
-	return false;
+	return true;
 }
 
 /*