linux-kernel - Re: [PATCH] sched: Fix NULL pointer dereference in sched_mm_cid

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <xhsmho6n3no4a.mognet@vschneid-thinkpadt14sgen2i.remote.csb>
Date: Fri, 09 Jan 2026 10:15:17 +0100
From: Valentin Schneider <vschneid@...hat.com>
To: Breno Leitao <leitao@...ian.org>, Ingo Molnar <mingo@...hat.com>, Peter
 Zijlstra <peterz@...radead.org>, Juri Lelli <juri.lelli@...hat.com>,
 Vincent Guittot <vincent.guittot@...aro.org>, Dietmar Eggemann
 <dietmar.eggemann@....com>, Steven Rostedt <rostedt@...dmis.org>, Ben
 Segall <bsegall@...gle.com>, Mel Gorman <mgorman@...e.de>
Cc: linux-kernel@...r.kernel.org, tj@...nel.org, kernel-team@...a.com, Breno
 Leitao <leitao@...ian.org>
Subject: Re: [PATCH] sched: Fix NULL pointer dereference in sched_mm_cid_fork()

On 30/12/25 06:34, Breno Leitao wrote:
> Function sched_mm_cid_fork() contains a WARN_ON_ONCE() check that
> triggers when mm is NULL, but execution continues regardless, leading to
> a NULL pointer dereference when attempting to lock &mm->mm_cid.mutex.
>
>       Unable to handle kernel NULL pointer dereference at virtual address 00000000000001e0
>       [00000000000001e0] user address but active_mm is swapper
>       Internal error: Oops: 0000000096000005 [#1]  SMP
>       Modules linked in:
>       CPU: 9 UID: 0 PID: 1 Comm: swapper/0 Tainted:
>       pc : __mutex_lock_common
>       Call trace:
>         __mutex_lock_common
>         mutex_lock_nested
>         sched_mm_cid_fork
>         sched_mm_cid_after_execve
>         bprm_execve
>
> This crash can occur during execve() failure paths where
> sched_mm_cid_after_execve() is called with a task that has a NULL mm.
>
> Fix this by making the function return early if the WARN_ON_ONCE()
> condition is true, preventing the NULL pointer dereference.
>
> Signed-off-by: Breno Leitao <leitao@...ian.org>
> ---
> I've inadvertently reproduced this bug by booting the kernel with an
> init binary from a different architecture.
>
> Specifically, I cross-compiled the kernel, but the init binary was built
> for an architecture that didn't match the kernel.
>
> With the applied fix, I now see the following line instead of
> experiencing a crash.
>
>    Kernel panic - not syncing: Requested init mybinary failed (error -8)

A slightly different fix is on its way, see:
https://lore.kernel.org/lkml/20251223215113.639686-1-xiyou.wangcong@gmail.com/