locking/mutex: Add MUTEX_WARN_ON() into fast path

Scenario: In platform_device_register, the driver misuses struct
device as platform_data, making kmemdup duplicate a device. Accessing
the duplicate may cause list corruption due to its mutex magic or list
holding old content.
It recurs randomly as the first mutex - getting process skips the slow
path and mutex check. Adding MUTEX_WARN_ON(lock->magic!= lock) in
__mutex_trylock_fast() makes it always happen.

Signed-off-by: Yunhui Cui <cuiyunhui@bytedance.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20250126033243.53069-1-cuiyunhui@bytedance.com

diff --git a/kernel/locking/mutex.c b/kernel/locking/mutex.c
index b36f23de48f1b544e9950a3ed20e0ba6b89b9fc5..19b636f60a24f114c552933c01c01de874623375 100644 (file)
--- a/kernel/locking/mutex.c
+++ b/kernel/locking/mutex.c
@@ -143,6 +143,8 @@ static __always_inline bool __mutex_trylock_fast(struct mutex *lock)
        unsigned long curr = (unsigned long)current;
        unsigned long zero = 0UL;
 
+       MUTEX_WARN_ON(lock->magic != lock);
+
        if (atomic_long_try_cmpxchg_acquire(&lock->owner, &zero, curr))
                return true;