rt-mutex: fix chain walk early wakeup bug

Alexey Kuznetsov found some problems in the pi-futex code.

One of the root causes is:

When a wakeup happens, we do not to stop the chain walk so we follow a not
longer relevant locking chain.

Drop out when this happens.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Ingo Molnar <mingo@elte.hu>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
Cc: Ulrich Drepper <drepper@redhat.com>
Cc: Eric Dumazet <dada1@cosmosbay.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

1 files changed, 13 insertions, 0 deletions

diff --git a/kernel/rtmutex.c b/kernel/rtmutex.c
index a273183c37a0..a6fbb4130521 100644
--- a/kernel/rtmutex.c
+++ b/kernel/rtmutex.c
@@ -189,6 +189,19 @@ int rt_mutex_adjust_prio_chain(struct task_struct *task,
         if (!waiter || !waiter->task)
                 goto out_unlock_pi;
 
+        /*
+         * Check the orig_waiter state. After we dropped the locks,
+         * the previous owner of the lock might have released the lock
+         * and made us the pending owner:
+         */
+        if (orig_waiter && !orig_waiter->task)
+                goto out_unlock_pi;
+
+        /*
+         * Drop out, when the task has no waiters. Note,
+         * top_waiter can be NULL, when we are in the deboosting
+         * mode!
+         */
         if (top_waiter && (!task_has_pi_waiters(task) ||
                            top_waiter != task_top_pi_waiter(task)))
                 goto out_unlock_pi;