linux-kernel - [PATCH] sched: Fix NULL pointer dereference in sched_mm_cid

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20251230-sched-v1-1-dd4b2a21cef4@debian.org>
Date: Tue, 30 Dec 2025 06:34:07 -0800
From: Breno Leitao <leitao@...ian.org>
To: Ingo Molnar <mingo@...hat.com>, Peter Zijlstra <peterz@...radead.org>, 
 Juri Lelli <juri.lelli@...hat.com>, 
 Vincent Guittot <vincent.guittot@...aro.org>, 
 Dietmar Eggemann <dietmar.eggemann@....com>, 
 Steven Rostedt <rostedt@...dmis.org>, Ben Segall <bsegall@...gle.com>, 
 Mel Gorman <mgorman@...e.de>, Valentin Schneider <vschneid@...hat.com>
Cc: linux-kernel@...r.kernel.org, tj@...nel.org, kernel-team@...a.com, 
 Breno Leitao <leitao@...ian.org>
Subject: [PATCH] sched: Fix NULL pointer dereference in sched_mm_cid_fork()

Function sched_mm_cid_fork() contains a WARN_ON_ONCE() check that
triggers when mm is NULL, but execution continues regardless, leading to
a NULL pointer dereference when attempting to lock &mm->mm_cid.mutex.

	Unable to handle kernel NULL pointer dereference at virtual address 00000000000001e0
	[00000000000001e0] user address but active_mm is swapper
	Internal error: Oops: 0000000096000005 [#1]  SMP
	Modules linked in:
	CPU: 9 UID: 0 PID: 1 Comm: swapper/0 Tainted:
	pc : __mutex_lock_common
	Call trace:
	  __mutex_lock_common
	  mutex_lock_nested
	  sched_mm_cid_fork
	  sched_mm_cid_after_execve
	  bprm_execve

This crash can occur during execve() failure paths where
sched_mm_cid_after_execve() is called with a task that has a NULL mm.

Fix this by making the function return early if the WARN_ON_ONCE()
condition is true, preventing the NULL pointer dereference.

Signed-off-by: Breno Leitao <leitao@...ian.org>
---
I've inadvertently reproduced this bug by booting the kernel with an
init binary from a different architecture.

Specifically, I cross-compiled the kernel, but the init binary was built
for an architecture that didn't match the kernel.

With the applied fix, I now see the following line instead of
experiencing a crash.

   Kernel panic - not syncing: Requested init mybinary failed (error -8)
---
 kernel/sched/core.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 41ba0be16911..eee5181fcc00 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -10566,7 +10566,8 @@ void sched_mm_cid_fork(struct task_struct *t)
 	struct mm_struct *mm = t->mm;
 	bool percpu;
 
-	WARN_ON_ONCE(!mm || t->mm_cid.cid != MM_CID_UNSET);
+	if (WARN_ON_ONCE(!mm || t->mm_cid.cid != MM_CID_UNSET))
+		return;
 
 	guard(mutex)(&mm->mm_cid.mutex);
 	scoped_guard(raw_spinlock_irq, &mm->mm_cid.lock) {

---
base-commit: 8640b74557fc8b4c300030f6ccb8cd078f665ec8
change-id: 20251230-sched-44236f6178af

Best regards,
--  
Breno Leitao <leitao@...ian.org>