From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from desiato.infradead.org (desiato.infradead.org [90.155.92.199]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7BD7C33C50D for ; Fri, 20 Feb 2026 10:20:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=90.155.92.199 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771582853; cv=none; b=UoC3ZtqPY6DBFGiu2eShZavVakfu9x0Fc9wYzfx4lqTAzTIbouKLc9KooXy0x0EFqt/oubc4CesFEmQP3iaaAIsIVfgPBjVb6VqRa2HsO4s3XfhPPks+VR8ODnWOsFmv/rHavqUX2iKykVnZSleQMn9vupotNVu6dgxkklxCF4E= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771582853; c=relaxed/simple; bh=AWeOjMGJkJRP59okg9PN5r4/E2N0HBU2SD1iUu1HFn8=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=eowtfR4Udcpg0je0/+nJ7cjNT4pgbBww2JynqBShHV7J5QSMG9hWg1/HvUAQuO5p2KbE/Dun6kYTfIjDutX2EM3BvMd+juAkxBLvKCxM/NPjSXHxdsO3It30Q+hyYQjsOKELTwrpfKTg5G+1lf/UQChyTHRa6I+UZiw4Hjv5FSM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=infradead.org; spf=none smtp.mailfrom=infradead.org; dkim=pass (2048-bit key) header.d=infradead.org header.i=@infradead.org header.b=PjSQW4/1; arc=none smtp.client-ip=90.155.92.199 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=infradead.org Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=infradead.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=infradead.org header.i=@infradead.org header.b="PjSQW4/1" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=desiato.20200630; h=In-Reply-To:Content-Type:MIME-Version: References:Message-ID:Subject:Cc:To:From:Date:Sender:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description; bh=irVUsTcalEZHquoawZx1GFlJZLLyt+aSNef1ZXaAt6o=; b=PjSQW4/14taSxbJa1dgjBZ4/2d 0KDf0RnfN2FDamWkX/wI+23h8w92jxKJOp8XzEFBEQDpdMfxe97cqzXH3OqZGuDijALvyGoDOLwda bndbioCm/owHZcn9E9bHV4Iu3lx77pFhWYSvMPwe6U1W5A6bSPa7j6/6qq9tvrrUhPyf6uBE7MaIC isXOLD4qakhZVeoTz9CrtRKAcaemMynXXEZ2TXenXHNXd/2J7vEImLilspfhKxUVMzijK4HmEtEih AyrUZLvrlbb/MrqLPBV3K25xmOA9UoXCMGRAn4rQEK+2js4JEg/Oin+i1979VMVo0G8giWfPF2fCI 5M+uB3lQ==; Received: from 77-249-17-252.cable.dynamic.v4.ziggo.nl ([77.249.17.252] helo=noisy.programming.kicks-ass.net) by desiato.infradead.org with esmtpsa (Exim 4.98.2 #2 (Red Hat Linux)) id 1vtNct-00000002ShM-3LK3; Fri, 20 Feb 2026 10:20:48 +0000 Received: by noisy.programming.kicks-ass.net (Postfix, from userid 1000) id 4C77C3030B3; Fri, 20 Feb 2026 11:20:47 +0100 (CET) Date: Fri, 20 Feb 2026 11:20:47 +0100 From: Peter Zijlstra To: Ethan Tidmore Cc: tglx@kernel.org, mpe@ellerman.id.au, cai@lca.pw, linux-kernel@vger.kernel.org Subject: Re: [PATCH] sched/core: Fix error pointer dereference Message-ID: <20260220102047.GM1282955@noisy.programming.kicks-ass.net> References: <20260217180633.524129-1-ethantidmore06@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260217180633.524129-1-ethantidmore06@gmail.com> On Tue, Feb 17, 2026 at 12:06:33PM -0600, Ethan Tidmore wrote: > The function idle_thread_get() can return an error pointer and is not > checked for one. Add check for error pointer. > > Detected by Smatch: > kernel/cpu.c:911 finish_cpu() error: > 'idle' dereferencing possible ERR_PTR() How could this possibly happen? > Signed-off-by: Ethan Tidmore > --- > kernel/cpu.c | 7 ++++++- > 1 file changed, 6 insertions(+), 1 deletion(-) > > diff --git a/kernel/cpu.c b/kernel/cpu.c > index bc4f7a9ba64e..30af888d1bc1 100644 > --- a/kernel/cpu.c > +++ b/kernel/cpu.c > @@ -908,7 +908,12 @@ static int bringup_cpu(unsigned int cpu) > static int finish_cpu(unsigned int cpu) > { > struct task_struct *idle = idle_thread_get(cpu); > - struct mm_struct *mm = idle->active_mm; > + struct mm_struct *mm; > + > + if (IS_ERR(idle)) > + return PTR_ERR(idle); > + > + mm = idle->active_mm; > > /* > * sched_force_init_mm() ensured the use of &init_mm, > -- > 2.53.0 >