linux-kernel - Re: [tip:sched/core] [sched/fair] 79104becf4: BUG:kernel_NULL_pointer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <37ebc412-5924-42ba-8919-af72deb98086@intel.com>
Date: Tue, 21 Oct 2025 14:39:58 +0800
From: "Chen, Yu C" <yu.c.chen@...el.com>
To: Fernand Sieber <sieberf@...zon.com>
CC: <oe-lkp@...ts.linux.dev>, <lkp@...el.com>, <linux-kernel@...r.kernel.org>,
	<x86@...nel.org>, Peter Zijlstra <peterz@...radead.org>,
	<aubrey.li@...ux.intel.com>, kernel test robot <oliver.sang@...el.com>
Subject: Re: [tip:sched/core] [sched/fair] 79104becf4:
 BUG:kernel_NULL_pointer_dereference,address

On 10/21/2025 1:14 PM, kernel test robot wrote:
> 
> 
> Hello,
> 
> kernel test robot noticed "BUG:kernel_NULL_pointer_dereference,address" on:
> 
> commit: 79104becf42baeeb4a3f2b106f954b9fc7c10a3c ("sched/fair: Forfeit vruntime on yield")
> https://git.kernel.org/cgit/linux/kernel/git/tip/tip.git sched/core
> 
> [   23.486344][ T3682] BUG: kernel NULL pointer dereference, address: 0000000000000051
> [   23.486846][ T3682] #PF: supervisor read access in kernel mode
> [   23.487189][ T3682] #PF: error_code(0x0000) - not-present page
> [   23.487532][ T3682] PGD 12b0a5067 P4D 12b0a5067 PUD 12b0b0067 PMD 0
> [   23.487905][ T3682] Oops: Oops: 0000 [#1]
> [   23.488147][ T3682] CPU: 0 UID: 65534 PID: 3682 Comm: trinity-c1 Not tainted 6.18.0-rc1-00001-g79104becf42b #1 PREEMPT
> [   23.488817][ T3682] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
> [   23.489401][ T3682] RIP: 0010:pick_task_fair (kernel/sched/fair.c:5526 kernel/sched/fair.c:8846)

Take a glance at the context, it seems to break here:
pick_next_entity(rq, cfs_rq)
   se = pick_eevdf(cfs_rq);
     se->sched_delayed   <=== se is NULL

In the original change, we force the current running
  se's vruntime moving forward and I guess for some
reason the corresponding cfs_rq->min_vruntime moves
forward too. Thus the rest se in the cfs_rq become
ineligible, and pick_eevdf() return NULL.

thanks,
Chenyu