linux-kernel - Re: [PATCH] sched: Fix NULL mm dereference in sched_mm_cid_after

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <d6ac8fe9-5fc0-4042-9592-cde3db82b65e@efficios.com>
Date: Wed, 24 Dec 2025 09:28:38 -0500
From: Mathieu Desnoyers <mathieu.desnoyers@...icios.com>
To: Cong Wang <xiyou.wangcong@...il.com>, linux-kernel@...r.kernel.org,
 Thomas Gleixner <tglx@...utronix.de>
Cc: peterz@...radead.org, Cong Wang <cwang@...tikernel.io>,
 Ingo Molnar <mingo@...nel.org>
Subject: Re: [PATCH] sched: Fix NULL mm dereference in
 sched_mm_cid_after_execve()

On 2025-12-23 16:51, Cong Wang wrote:
> From: Cong Wang <cwang@...tikernel.io>
> 
> sched_mm_cid_after_execve() is called in bprm_execve()'s cleanup path
> even when exec_binprm() fails. For the init task's first execve, this
> causes a problem:
> 
> 1. current->mm is NULL (kernel threads don't have an mm)
> 2. sched_mm_cid_before_execve() exits early because mm is NULL
> 3. exec_binprm() fails (e.g., ENOENT for missing script interpreter)
> 4. sched_mm_cid_after_execve() is called with mm still NULL
> 5. sched_mm_cid_fork() is called unconditionally, triggering WARN_ON
> 
> This is easily reproduced by booting with an init that is a shell script
> (#!/bin/sh) where the interpreter doesn't exist in the initramfs.
> 
> Fix this by checking if t->mm is NULL before calling sched_mm_cid_fork(),
> matching the behavior of sched_mm_cid_before_execve() which already
> handles this case via sched_mm_cid_exit()'s early return.
 >
 > Fixes: b0c3d51b54f8 ("sched/mmcid: Provide precomputed maximal value")
 > Cc: Thomas Gleixner <tglx@...utronix.de>
 > Signed-off-by: Cong Wang <cwang@...tikernel.io>

Thanks for the detailed explanation.

Indeed, the offending commit removes a pre-existing NULL mm check:

  void sched_mm_cid_after_execve(struct task_struct *t)
  {
-       struct mm_struct *mm = t->mm;
-
-       if (!mm)
-               return;

Reviewed-by: Mathieu Desnoyers <mathieu.desnoyers@...icios.com>

Thomas, Peter, Ingo, can we fast-track this fix for upstream ?

Thanks,

Mathieu

-- 
Mathieu Desnoyers
EfficiOS Inc.
https://www.efficios.com