linux-kernel - Re: [PATCH] sched/eevdf: Fix NULL pointer dereference in pick

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20250520064329.831391-1-limingming3@lixiang.com>
Date: Tue, 20 May 2025 14:43:29 +0800
From: limingming3 <limingming890315@...il.com>
To: peterz@...radead.org
Cc: bsegall@...gle.com,
	dietmar.eggemann@....com,
	juri.lelli@...hat.com,
	limingming3@...iang.com,
	limingming890315@...il.com,
	linux-kernel@...r.kernel.org,
	mgorman@...e.de,
	mingo@...hat.com,
	rostedt@...dmis.org,
	stable@...r.kernel.org,
	vincent.guittot@...aro.org,
	vschneid@...hat.com
Subject: Re: [PATCH] sched/eevdf: Fix NULL pointer dereference in pick_eevdf()

On Mon, 19 May 2025 11:38:57 +0200, Peter wrote:
>
>On Mon, May 19, 2025 at 05:25:39PM +0800, limingming3 wrote:
>> pick_eevdf() may return NULL, which would triggers NULL pointer
>> dereference and crash when best and curr are both NULL.
>> 
>> There are two cases when curr would be NULL:
>> 	1) curr is NULL when enter pick_eevdf
>> 	2) we set it to NUll when curr is not on_rq or eligible.
>> 
>> And when we went to the best = curr flow, the se should never be NULL,
>> So when best and curr are both NULL, we'd better set best = se to avoid
>> return NULL.
>> 
>> Below crash is what I encounter very low probability on our server and
>> I have not reproduce it, and I also found other people feedback some
>> similar crash on lore. So believe the issue is really exit.
>
>If you've found those emails, you'll also have found me telling them
>this is the wrong fix.
>
>This (returning NULL) can only happen when the internal state is
>broken. Ignoring the NULL will then hide the actual problem.

Thank you for patiently reply, I thought before the curent flow might
not deal with the case when curr and best are both NULL.

Now I got your mean, the current flow would never return NULL except
the internal state is broken.

>
>Can you reproduce on the latest kernels?, 6.1 is so old I don't even
>remember what's in there.

We have not reproduced it on the latest kernels.

We merged the eevdf to our kernel 6.1, and we just encounter several
crashes on our server, and all of them  are at the boot up time.

Maybe there are some bug on our portings and I would add much more debug
info in pick_eevdf() to debug.