linux-kernel - Re: [PATCH] sched: Fix NULL mm dereference in sched_mm_cid_after

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <cf2cf31a-d070-431f-8afb-98afd27bc92a@efficios.com>
Date: Thu, 8 Jan 2026 10:28:30 -0500
From: Mathieu Desnoyers <mathieu.desnoyers@...icios.com>
To: Will Deacon <will@...nel.org>, Cong Wang <xiyou.wangcong@...il.com>
Cc: linux-kernel@...r.kernel.org, peterz@...radead.org,
 Cong Wang <cwang@...tikernel.io>, Thomas Gleixner <tglx@...utronix.de>,
 Ingo Molnar <mingo@...nel.org>,
 Linus Torvalds <torvalds@...ux-foundation.org>
Subject: Re: [PATCH] sched: Fix NULL mm dereference in
 sched_mm_cid_after_execve()

On 2026-01-07 13:00, Will Deacon wrote:
> On Tue, Dec 23, 2025 at 01:51:13PM -0800, Cong Wang wrote:
>> From: Cong Wang <cwang@...tikernel.io>
>>
>> sched_mm_cid_after_execve() is called in bprm_execve()'s cleanup path
>> even when exec_binprm() fails. For the init task's first execve, this
>> causes a problem:
>>
>> 1. current->mm is NULL (kernel threads don't have an mm)
>> 2. sched_mm_cid_before_execve() exits early because mm is NULL
>> 3. exec_binprm() fails (e.g., ENOENT for missing script interpreter)
>> 4. sched_mm_cid_after_execve() is called with mm still NULL
>> 5. sched_mm_cid_fork() is called unconditionally, triggering WARN_ON
>>
>> This is easily reproduced by booting with an init that is a shell script
>> (#!/bin/sh) where the interpreter doesn't exist in the initramfs.
>>
>> Fix this by checking if t->mm is NULL before calling sched_mm_cid_fork(),
>> matching the behavior of sched_mm_cid_before_execve() which already
>> handles this case via sched_mm_cid_exit()'s early return.
>>
>> Fixes: b0c3d51b54f8 ("sched/mmcid: Provide precomputed maximal value")
>> Cc: Thomas Gleixner <tglx@...utronix.de>
>> Signed-off-by: Cong Wang <cwang@...tikernel.io>
>> ---
>>   kernel/sched/core.c | 5 +++--
>>   1 file changed, 3 insertions(+), 2 deletions(-)
>>
>> diff --git a/kernel/sched/core.c b/kernel/sched/core.c
>> index 41ba0be16911..60afadb6eede 100644
>> --- a/kernel/sched/core.c
>> +++ b/kernel/sched/core.c
>> @@ -10694,10 +10694,11 @@ void sched_mm_cid_before_execve(struct task_struct *t)
>>   	sched_mm_cid_exit(t);
>>   }
>>   
>> -/* Reactivate MM CID after successful execve() */
>> +/* Reactivate MM CID after execve() */
>>   void sched_mm_cid_after_execve(struct task_struct *t)
>>   {
>> -	sched_mm_cid_fork(t);
>> +	if (t->mm)
>> +		sched_mm_cid_fork(t);
>>   }
>>   
>>   static void mm_cid_work_fn(struct work_struct *work)
> 
> This addresses a panic reported on arm64 when trying to execute x86
> binaries using TCG on an Apple device:
> 
> https://lore.kernel.org/all/20251226192506.88593-1-za4emsu@gmail.com/
> 
> so:
> 
> Acked-by: Will Deacon <will@...nel.org>
> 
> Please can we land this for 6.19?

Yes, please. I gave my Reviewed-by already 2 weeks ago:

https://lore.kernel.org/lkml/d6ac8fe9-5fc0-4042-9592-cde3db82b65e@efficios.com/

I guess the relevant maintainers are gradually coming back from the holiday break.
I will ask it again here: can we fast-track this fix for upstream ?

Thanks,

Mathieu

> 
> Cheers,
> 
> Will


-- 
Mathieu Desnoyers
EfficiOS Inc.
https://www.efficios.com