linux-kernel - [tip: sched/urgent] sched/mm_cid: Prevent NULL mm dereference in sched_mm_cid_after

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <176796033688.510.2605056571822363443.tip-bot2@tip-bot2>
Date: Fri, 09 Jan 2026 12:05:36 -0000
From: "tip-bot2 for Cong Wang" <tip-bot2@...utronix.de>
To: linux-tip-commits@...r.kernel.org
Cc: Cong Wang <cwang@...tikernel.io>, Thomas Gleixner <tglx@...nel.org>,
 Mathieu Desnoyers <mathieu.desnoyers@...icios.com>,
 Will Deacon <will@...nel.org>, x86@...nel.org, linux-kernel@...r.kernel.org
Subject: [tip: sched/urgent] sched/mm_cid: Prevent NULL mm dereference in
 sched_mm_cid_after_execve()

The following commit has been merged into the sched/urgent branch of tip:

Commit-ID:     2bdf777410dc6e022d1081885ff34673b5dfee99
Gitweb:        https://git.kernel.org/tip/2bdf777410dc6e022d1081885ff34673b5dfee99
Author:        Cong Wang <cwang@...tikernel.io>
AuthorDate:    Tue, 23 Dec 2025 13:51:13 -08:00
Committer:     Thomas Gleixner <tglx@...nel.org>
CommitterDate: Fri, 09 Jan 2026 13:02:57 +01:00

sched/mm_cid: Prevent NULL mm dereference in sched_mm_cid_after_execve()

sched_mm_cid_after_execve() is called in bprm_execve()'s cleanup path even
when exec_binprm() fails. For the init task's first execve(), this causes a
problem:

  1. current->mm is NULL (kernel threads don't have an mm)
  2. sched_mm_cid_before_execve() exits early because mm is NULL
  3. exec_binprm() fails (e.g., ENOENT for missing script interpreter)
  4. sched_mm_cid_after_execve() is called with mm still NULL
  5. sched_mm_cid_fork() is called unconditionally, triggering WARN_ON

This is easily reproduced by booting with an init that is a shell script
(#!/bin/sh) where the interpreter doesn't exist in the initramfs.

Fix this by checking if t->mm is NULL before calling sched_mm_cid_fork(),
matching the behavior of sched_mm_cid_before_execve() which already
handles this case via sched_mm_cid_exit()'s early return.

Fixes: b0c3d51b54f8 ("sched/mmcid: Provide precomputed maximal value")
Signed-off-by: Cong Wang <cwang@...tikernel.io>
Signed-off-by: Thomas Gleixner <tglx@...nel.org>
Reviewed-by: Mathieu Desnoyers <mathieu.desnoyers@...icios.com>
Acked-by: Will Deacon <will@...nel.org>
Link: https://patch.msgid.link/20251223215113.639686-1-xiyou.wangcong@gmail.com
---
 kernel/sched/core.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 41ba0be..60afadb 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -10694,10 +10694,11 @@ void sched_mm_cid_before_execve(struct task_struct *t)
 	sched_mm_cid_exit(t);
 }

-/* Reactivate MM CID after successful execve() */
+/* Reactivate MM CID after execve() */
 void sched_mm_cid_after_execve(struct task_struct *t)
 {
-	sched_mm_cid_fork(t);
+	if (t->mm)
+		sched_mm_cid_fork(t);
 }

 static void mm_cid_work_fn(struct work_struct *work)