kernel 中 对 mutex 使用了memset 导致了 mutex_lock_nested 中出现了kernel panic

假设定义了一个结构体

struct mutex_lock {
        struct mutex lock;
    }
struct mutex_lock mutex_lock_t;

在 mutex_init(&mutex_lock_t.lock)

在后面的函数中调用了 memset(&mutex_lock_t,0,sizeof(struct mutex_lock)) , 会导致 mutex_lock_t 中的 lock 对应被 mutex_init 初始化的指针被置为NULL，从而导致在下次调用 mutex_lock(&mutex_lock_t.lock);会出现如下错误

(191112_17:38:15.640)[ 2383.176814] [A]Unable to handle kernel NULL pointer dereference at virtual address 00000000
(191112_17:38:15.650)[ 2383.176819] [A]pgd = ffffffc04e250000
(191112_17:38:15.650)[ 2383.176827] [A][00000000] *pgd=0000000000000000, *pud=0000000000000000
(191112_17:38:15.650)[ 2383.176835] [Em]Internal error: Oops: 96000045 [#1] PREEMPT SMP
(191112_17:38:15.650)[ 2383.176843] Modules linked in:
(191112_17:38:15.650)[ 2383.176853] CPU: 0 PID: 2540 Comm: camerahalserver Tainted: G        W       4.9.118+ #30
(191112_17:38:15.651)[ 2383.176856] Hardware name:  ANDROID (DT)
(191112_17:38:15.651)[ 2383.176859] task: ffffffc036240000 task.stack: ffffffc0333a4000
(191112_17:38:15.651)[ 2383.176874] PC is at mutex_lock_nested+0x114/0x3b8
(191112_17:38:15.651)[ 2383.176879] LR is at mutex_lock_nested+0x104/0x3b8
(191112_17:38:15.651)[ 2383.176884] pc : [<ffffff8008a7a8dc>] lr : [<ffffff8008a7a8cc>] pstate: 804001c5
(191112_17:38:15.651)[ 2383.176886] sp : ffffffc0333a7a10
(191112_17:38:15.651)[ 2383.176893] x29: ffffffc0333a7a10 x28: ffffff8009f0e088 
(191112_17:38:15.651)[ 2383.176900] x27: ffffff8008d518e0 x26: ffffff8009f0ab20 
(191112_17:38:15.651)[ 2383.176906] x25: ffffffc0333a7a88 x24: ffffff8009148000 
(191112_17:38:15.651)[ 2383.176913] x23: ffffffc036240000 x22: ffffff8009e9d000 
(191112_17:38:15.651)[ 2383.176919] x21: 0000000000000140 x20: ffffff8009f0e048 
(191112_17:38:15.651)[ 2383.176926] x19: ffffff8009f0e050 x18: 0000007fe4f8d0ca 
(191112_17:38:15.651)[ 2383.176932] x17: 0000007745f6d218 x16: ffffff8008254ebc 
(191112_17:38:15.651)[ 2383.176938] x15: ffffffffffffffff x14: ffffffffff000000 
(191112_17:38:15.651)[ 2383.176945] x13: ffffffffffffffff x12: 0000007fe4f8d908 
(191112_17:38:15.651)[ 2383.176951] x11: 0000000000000039 x10: ffffff8009f0e0a8 
(191112_17:38:15.651)[ 2383.176957] x9 : 0000000000000000 x8 : ffffffc0333a7aa8 
(191112_17:38:15.652)[ 2383.176963] x7 : 1111111111111111 x6 : 0000000000000000 
(191112_17:38:15.652)[ 2383.176969] x5 : 0000000000000000 x4 : 0000000000000008 
(191112_17:38:15.652)[ 2383.176975] x3 : ffffffc0333a7a88 x2 : ffffffc036240000 
(191112_17:38:15.652)[ 2383.176980] x1 : 0000000000000000 x0 : 0000000000000000 

参考 https://elixir.bootlin.com/linux/v4.9.185/source/include/linux/mutex.h
中给出了定义和使用规范

/*
 * Simple, straightforward mutexes with strict semantics:
 *
 * - only one task can hold the mutex at a time
 * - only the owner can unlock the mutex
 * - multiple unlocks are not permitted
 * - recursive locking is not permitted
 * - a mutex object must be initialized via the API
 * - a mutex object must not be initialized via memset or copying
 * - task may not exit with mutex held
 * - memory areas where held locks reside must not be freed
 * - held mutexes must not be reinitialized
 * - mutexes may not be used in hardware or software interrupt
 *   contexts such as tasklets and timers
 *
 * These semantics are fully enforced when DEBUG_MUTEXES is
 * enabled. Furthermore, besides enforcing the above rules, the mutex
 * debugging code also implements a number of additional features
 * that make lock debugging easier and faster:
 *
 * - uses symbolic names of mutexes, whenever they are printed in debug output
 * - point-of-acquire tracking, symbolic lookup of function names
 * - list of all locks held in the system, printout of them
 * - owner tracking
 * - detects self-recursing locks and prints out all relevant info
 * - detects multi-task circular deadlocks and prints out all affected
 *   locks and tasks (and only those tasks)
 */
 
struct mutex {
	/* 1: unlocked, 0: locked, negative: locked, possible waiters */
	atomic_t		count;
	spinlock_t		wait_lock;
	struct list_head	wait_list;
#if defined(CONFIG_DEBUG_MUTEXES) || defined(CONFIG_MUTEX_SPIN_ON_OWNER)
	struct task_struct	*owner;
#endif
#ifdef CONFIG_MUTEX_SPIN_ON_OWNER
	struct optimistic_spin_queue osq; /* Spinner MCS lock */
#endif
#ifdef CONFIG_DEBUG_MUTEXES
	void			*magic;
#endif
#ifdef CONFIG_DEBUG_LOCK_ALLOC
	struct lockdep_map	dep_map;
#endif
};