linux-kernel - Re: NULL pointer dereference in pick_next_task

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 31 Oct 2019 11:54:04 +0100
From:   Valentin Schneider <valentin.schneider@....com>
To:     Ram Muthiah <rammuthiah@...gle.com>,
        Quentin Perret <qperret@...gle.com>
Cc:     Peter Zijlstra <peterz@...radead.org>,
        linux-kernel@...r.kernel.org, aaron.lwe@...il.com,
        mingo@...nel.org, pauld@...hat.com, jdesfossez@...italocean.com,
        naravamudan@...italocean.com, vincent.guittot@...aro.org,
        dietmar.eggemann@....com, juri.lelli@...hat.com,
        rostedt@...dmis.org, bsegall@...gle.com, mgorman@...e.de,
        kernel-team@...roid.com, john.stultz@...aro.org
Subject: Re: NULL pointer dereference in pick_next_task_fair

On 31/10/2019 02:33, Valentin Schneider wrote:
> For wakeups, select_task_rq_fair() can only ever pick prev_cpu or this_cpu
> since there are no sched domains. I don't see many candidates that could
> wakeup on a secondary (thus have non-zero this_cpu) this early there. Perhaps
> the smpboot threads, but from a quick look they are first created *after*
> sched_init_smp(), so they couldn't exist during (boot-time) secondary bringup.

Scratch that, I can't read. The registration is done in early initcalls (and
we have the unpark in the secondary bringup anyway), so when we spool up the
secondaries we'll get wakeups for the smpboot threads. AFAIR only softirqd
and cpuhp are CFS, but while this satisfied some of my curiosity this doesn't
seem super helpful on its own.

> Seems to be the same for IRQ threads (and they're setscheduler'd to FIFO
> anyway).
> 
> So now I'm even more curious as to what CFS task could be enqueued on a
> secondary CPU rq before sched_init_smp(). Have you been sending stuff to space
> without any shielding lately?
>