[PATCH] sched: Fix NULL pointer dereference in sched_mm_cid_fork()

[PATCH] sched: Fix NULL pointer dereference in sched_mm_cid_fork()

[Breno Leitao]

Function sched_mm_cid_fork() contains a WARN_ON_ONCE() check that
triggers when mm is NULL, but execution continues regardless, leading to
a NULL pointer dereference when attempting to lock &mm->mm_cid.mutex.

	Unable to handle kernel NULL pointer dereference at virtual address 00000000000001e0
	[00000000000001e0] user address but active_mm is swapper
	Internal error: Oops: 0000000096000005 [#1]  SMP
	Modules linked in:
	CPU: 9 UID: 0 PID: 1 Comm: swapper/0 Tainted:
	pc : __mutex_lock_common
	Call trace:
	  __mutex_lock_common
	  mutex_lock_nested
	  sched_mm_cid_fork
	  sched_mm_cid_after_execve
	  bprm_execve

This crash can occur during execve() failure paths where
sched_mm_cid_after_execve() is called with a task that has a NULL mm.

Fix this by making the function return early if the WARN_ON_ONCE()
condition is true, preventing the NULL pointer dereference.

Signed-off-by: Breno Leitao <leitao@debian.org>
---
I've inadvertently reproduced this bug by booting the kernel with an
init binary from a different architecture.

Specifically, I cross-compiled the kernel, but the init binary was built
for an architecture that didn't match the kernel.

With the applied fix, I now see the following line instead of
experiencing a crash.

   Kernel panic - not syncing: Requested init mybinary failed (error -8)
---
 kernel/sched/core.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 41ba0be16911..eee5181fcc00 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -10566,7 +10566,8 @@ void sched_mm_cid_fork(struct task_struct *t)
 	struct mm_struct *mm = t->mm;
 	bool percpu;
 
-	WARN_ON_ONCE(!mm || t->mm_cid.cid != MM_CID_UNSET);
+	if (WARN_ON_ONCE(!mm || t->mm_cid.cid != MM_CID_UNSET))
+		return;
 
 	guard(mutex)(&mm->mm_cid.mutex);
 	scoped_guard(raw_spinlock_irq, &mm->mm_cid.lock) {

---
base-commit: 8640b74557fc8b4c300030f6ccb8cd078f665ec8
change-id: 20251230-sched-44236f6178af

Best regards,
--  
Breno Leitao <leitao@debian.org>

Re: [PATCH] sched: Fix NULL pointer dereference in sched_mm_cid_fork()

[Valentin Schneider]

On 30/12/25 06:34, Breno Leitao wrote:
> Function sched_mm_cid_fork() contains a WARN_ON_ONCE() check that
> triggers when mm is NULL, but execution continues regardless, leading to
> a NULL pointer dereference when attempting to lock &mm->mm_cid.mutex.
>
>       Unable to handle kernel NULL pointer dereference at virtual address 00000000000001e0
>       [00000000000001e0] user address but active_mm is swapper
>       Internal error: Oops: 0000000096000005 [#1]  SMP
>       Modules linked in:
>       CPU: 9 UID: 0 PID: 1 Comm: swapper/0 Tainted:
>       pc : __mutex_lock_common
>       Call trace:
>         __mutex_lock_common
>         mutex_lock_nested
>         sched_mm_cid_fork
>         sched_mm_cid_after_execve
>         bprm_execve
>
> This crash can occur during execve() failure paths where
> sched_mm_cid_after_execve() is called with a task that has a NULL mm.
>
> Fix this by making the function return early if the WARN_ON_ONCE()
> condition is true, preventing the NULL pointer dereference.
>
> Signed-off-by: Breno Leitao <leitao@debian.org>
> ---
> I've inadvertently reproduced this bug by booting the kernel with an
> init binary from a different architecture.
>
> Specifically, I cross-compiled the kernel, but the init binary was built
> for an architecture that didn't match the kernel.
>
> With the applied fix, I now see the following line instead of
> experiencing a crash.
>
>    Kernel panic - not syncing: Requested init mybinary failed (error -8)

A slightly different fix is on its way, see:
https://lore.kernel.org/lkml/20251223215113.639686-1-xiyou.wangcong@gmail.com/