linux-kernel - Re: [BUG] Kernel panic in __migrate_swap_task() on 6.16-rc2 (NULL pointer dereference)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <d0b7b52b-c370-4ad7-8a03-d785f1505372@intel.com>
Date: Fri, 27 Jun 2025 15:33:29 +0800
From: "Chen, Yu C" <yu.c.chen@...el.com>
To: Jirka Hladky <jhladky@...hat.com>, Abhigyan ghosh
	<zscript.team.zs@...il.com>
CC: <linux-kernel@...r.kernel.org>, Chen Yu <yu.chen.surf@...mail.com>
Subject: Re: [BUG] Kernel panic in __migrate_swap_task() on 6.16-rc2 (NULL
 pointer dereference)

On 6/27/2025 3:16 PM, Chen, Yu C wrote:
> Hi Jirka,
> 
> On 6/27/2025 5:46 AM, Jirka Hladky wrote:
>> Hi Chen and all,
>>
>> we have now verified that the following commit causes a kernel panic
>> discussed in this thread:
>>
>> ad6b26b6a0a79 sched/numa: add statistics of numa balance task
>>
>> Reverting this commit fixes the issue.
>>
>> I'm happy to help debug this further or test a proposed fix.
>>
> 
> Thanks very much for your report, it seems that there is a
> race condition that when the swap task candidate was chosen,
> but its mm_struct get released due to task exit, then later
> when doing the task swaping, the p->mm is NULL which caused
> the problem:
> 
> CPU0                                   CPU1
> :
> ...
> task_numa_migrate
>    task_numa_find_cpu
>     task_numa_compare
>       # a normal task p is chosen
>       env->best_task = p
> 
>                                         # p exit:
>                                         exit_signals(p);
>                                            p->flags |= PF_EXITING
>                                         exit_mm
>                                            p->mm = NULL;
> 
>     migrate_swap_stop
>       __migrate_swap_task((arg->src_task, arg->dst_cpu)
>        count_memcg_event_mm(p->mm, NUMA_TASK_SWAP)# p->mm is NULL
> 
> Could you please help check if the following debug patch works,

Attached the patch:

diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 8988d38d46a3..82fc966b390c 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -3364,7 +3364,12 @@ static void __migrate_swap_task(struct 
task_struct *p, int cpu)
  {
  	__schedstat_inc(p->stats.numa_task_swapped);
  	count_vm_numa_event(NUMA_TASK_SWAP);
-	count_memcg_event_mm(p->mm, NUMA_TASK_SWAP);
+	if (unlikely(!p->mm)) {
+		trace_printk("!! (%d %s) flags=%lx\n", p->pid, p->comm,
+				p->flags);
+	} else {
+		count_memcg_event_mm(p->mm, NUMA_TASK_SWAP);
+	}

  	if (task_on_rq_queued(p)) {
  		struct rq *src_rq, *dst_rq;
-- 
2.25.1

> and if there is no issue found after you ran several tests,
> could you please provide the
> /sys/kernel/debug/tracing/trace
> 
> BTW, is it possible to share your test script for stress-ng,
> stream? It looks like the stress-ng's fork test case would
> trigger this issue easier in theory.
> 
> thanks,
> Chenyu
> 
>