From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 06335229B2A for ; Wed, 25 Feb 2026 06:34:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772001288; cv=none; b=aorwFWNwYtoK4sED/5JQFJDatTQWl8EssFdKAPNLh9EsUkOOPqJ5w1tDimrnJW5AWwtGRZUbT8MKkRqV79iMcjraiMN8RREuBFW2Df/Xj1FDE8zuO4goER1Zr0bF4E29z31mCo7hnoZA5MG6ufaAaJiZaAlfz13AFGRsjryveLo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772001288; c=relaxed/simple; bh=KLxBg42SI5qqJn6x0Aw56CWo8tZSqLljrMc3PY2v1i8=; h=From:Message-ID:Date:MIME-Version:Subject:To:Cc:References: In-Reply-To:Content-Type; b=VJlIxPmM1rW5arDYs/jXz8INKeqCKieMHQpY1G9dCrhM6wWbUKeZDcFOFg/OdEwAA8EIBKfjRrn8BbaByBpgYALkqohZRwyNFm2bbpihw2qWTQph1SPxMRijkqd1zyLIIpa8nl3npK4q05fxu7oxFh9vi4pPODci7a06N18MAv0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=NkSrJX+Z; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b=rOa8MY8f; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="NkSrJX+Z"; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b="rOa8MY8f" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1772001285; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=pLd2XQBnJ1Hr7SICN8JmqPACHbkEFAOR+6MAVERvw6M=; b=NkSrJX+Z2J3KekL9hNLWKnhXQg9N465U7YiDvXahRafCXLzEhsBtdyrv4uBvIJaZ3fh+Je DJ8jvHqm8+u60qitoEGbGcLAakagHJsJjZjHUE6X+y4OgZYv+UnDGfn1QXktEcCPvj6xIS i8hctXZpsT5vjPaHjK5uCjFtQUigyvU= Received: from mail-qt1-f198.google.com (mail-qt1-f198.google.com [209.85.160.198]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-642-uuAETWjvOVmDFpTnnoGWJg-1; Wed, 25 Feb 2026 01:34:44 -0500 X-MC-Unique: uuAETWjvOVmDFpTnnoGWJg-1 X-Mimecast-MFC-AGG-ID: uuAETWjvOVmDFpTnnoGWJg_1772001284 Received: by mail-qt1-f198.google.com with SMTP id d75a77b69052e-503915b0a88so430606921cf.1 for ; Tue, 24 Feb 2026 22:34:44 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1772001284; x=1772606084; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:content-language:references :cc:to:subject:user-agent:mime-version:date:message-id:from:from:to :cc:subject:date:message-id:reply-to; bh=pLd2XQBnJ1Hr7SICN8JmqPACHbkEFAOR+6MAVERvw6M=; b=rOa8MY8fAkv5VWjz+wzkHMgD6HUbrzcHEw2SpIlZVnktzNn35WajCeFsoQ5F8z6XXo RUnvXeo8X4XozF8JoTWOXm2Tb7jgyTUe6V4kEZ8SLf4ZMGQe63/9wmMFXdHGD1V0tYsi G6oShNrJ1IjEjE7QfssVh/MGYiXjb9ESFRKuXfpk2macG2eJ6L3MIcP9/xBIzxzDHWn8 LHMsu2yovG/uK+AFb0oW2kYeCkjLYtD0+4kZdePq4k97DYffAojaaBVGhVmC0fWePj8i x1E8MIxebtrQL/2JBLJur+BJCJiJB3RfAoHfoOhvVMO0cOVRBIEg/VexOfxbv1Aujqy2 hbYg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1772001284; x=1772606084; h=content-transfer-encoding:in-reply-to:content-language:references :cc:to:subject:user-agent:mime-version:date:message-id:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=pLd2XQBnJ1Hr7SICN8JmqPACHbkEFAOR+6MAVERvw6M=; b=SNFCegH7S2CQ39LPagc4TAVDuNxZO54XZx8hgTtFZmECKSvUrCnsqGdF1P+xTMIV1C 0P29g7DYDeNHia7r0Lmj6Tb1I19oxxTRjj60nWjyOTMzz15BVFXL1GTkSZbbsL9+OeAD 2wtKnbCbBQk2lbWmMi5Z65b7Qk9dI6bcr76ejRnF0zgCSIPt8TJ+Oc7Nbi3mJASoVEYc BIk1rsyPvyw3ZNO8nzSh6W90gcNf7HOEKTb0H73U2URgnodlNIwFnW3anHrVqqNO3I83 tCTOqfj4e3Q0qDwlZR/oDjc3XA4nmcqpcciiJVGflM9JWq3G80R5zzRZyZZZBHc3v0jf CXLA== X-Forwarded-Encrypted: i=1; AJvYcCVac8nm5MMBakA9qGgwNw+HU2Naz/AXZz6NiQEI2aDnDNfHQ56ktDu5zRElKh7vOBqA9M6/4a83e0yUyI0=@vger.kernel.org X-Gm-Message-State: AOJu0YzdG35IOlps5GZMDYdhg1agqDGx5EZr2fwLYpiUabp5POY+LD9T jegsdJIf46fQMIn3qVD5QdOgrRRHgH/mPNASxgjglgcpLvTlGly6N/eTmHLwmlBarXuVwjikreC Wol9hjaR1lJ2WtJJ/yQJn62F3YgUYJ6u63CZvKaUNHa1IjbC6AqdIWzHz4fwZopeV7Q== X-Gm-Gg: ATEYQzwyZ7ysAqXZoFllCvHgwEqCj30lUCwMoi1uhr6zNb/kSxh6YGMWTobueP5pzUh nr+X/kPsz766hGGd/Jqpj9YdeUj/BGuLaPrllreopOzQ65H00AeRjmD1LEdCk616Wy0UK3TaQ4i 4KCOPb4ExeQr3BEEbQpVZ9uEd3tcU7gXUw9q71P7wkUkgX/DxHh7kiw5iIcGYDBwDwPAADVHKp6 obilm6x0fixDaq9j0/ysErsR52q/AYVeH3xocW1USfV+W/1cr0Nm2Q9dACCYuMoxeftQBfyh7FI e9mBNuT1mYmN4LaQBlr/PCeHrg+GhSJLxVpwPWFSoW/gD7/gyu4syD/l2jCbKvuiHUDunH9qQIN J/Tzf/KyzaQRDs6/OWjMTd02FPlgiscBkR2NhMdbt+XPbl7XxnPIhkXt0H/CsuWDW8fHG X-Received: by 2002:ac8:5854:0:b0:503:2f49:6f81 with SMTP id d75a77b69052e-5073a35947amr15070841cf.74.1772001283980; Tue, 24 Feb 2026 22:34:43 -0800 (PST) X-Received: by 2002:ac8:5854:0:b0:503:2f49:6f81 with SMTP id d75a77b69052e-5073a35947amr15070721cf.74.1772001283586; Tue, 24 Feb 2026 22:34:43 -0800 (PST) Received: from ?IPV6:2601:600:947f:f020:85dc:d2b2:c5ee:e3c4? ([2601:600:947f:f020:85dc:d2b2:c5ee:e3c4]) by smtp.gmail.com with ESMTPSA id d75a77b69052e-5070d550785sm143966001cf.11.2026.02.24.22.34.42 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 24 Feb 2026 22:34:43 -0800 (PST) From: Waiman Long X-Google-Original-From: Waiman Long Message-ID: <35c806f0-39ba-42c2-87f2-f3f3a6772ed2@redhat.com> Date: Wed, 25 Feb 2026 01:34:41 -0500 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH -next] cgroup/cpuset: fix null-ptr-deref in rebuild_sched_domains_cpuslocked To: Chen Ridong , tj@kernel.org, hannes@cmpxchg.org, mkoutny@suse.com Cc: cgroups@vger.kernel.org, linux-kernel@vger.kernel.org, lujialin4@huawei.com References: <20260225011523.51365-1-chenridong@huaweicloud.com> Content-Language: en-US In-Reply-To: <20260225011523.51365-1-chenridong@huaweicloud.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit On 2/24/26 8:15 PM, Chen Ridong wrote: > From: Chen Ridong > > A null-pointer-dereference bug was reported by syzbot: > > Oops: general protection fault, probably for address 0xdffffc0000000000: > KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] > RIP: 0010:bitmap_subset include/linux/bitmap.h:433 [inline] > RIP: 0010:cpumask_subset include/linux/cpumask.h:836 [inline] > RIP: 0010:rebuild_sched_domains_locked kernel/cgroup/cpuset.c:967 > RSP: 0018:ffffc90003ecfbc0 EFLAGS: 00010246 > RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000020 > RDX: ffff888028de0000 RSI: ffffffff8200f003 RDI: ffffffff8df14f28 > RBP: 0000000000000000 R08: 0000000000000cc0 R09: 00000000ffffffff > R10: ffffffff8e7d95b3 R11: 0000000000000001 R12: 0000000000000000 > R13: 00000000000f4240 R14: dffffc0000000000 R15: 0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 0000001b2f463fff CR3: 000000003704c000 CR4: 00000000003526f0 > Call Trace: > > rebuild_sched_domains_cpuslocked kernel/cgroup/cpuset.c:983 [inline] > rebuild_sched_domains+0x21/0x40 kernel/cgroup/cpuset.c:990 > sched_rt_handler+0xb5/0xe0 kernel/sched/rt.c:2911 > proc_sys_call_handler+0x47f/0x5a0 fs/proc/proc_sysctl.c:600 > new_sync_write fs/read_write.c:595 [inline] > vfs_write+0x6ac/0x1070 fs/read_write.c:688 > ksys_write+0x12a/0x250 fs/read_write.c:740 > do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] > do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94 > entry_SYSCALL_64_after_hwframe+0x77/0x7f > > The issue occurs when generate_sched_domains() returns ndoms = 1 and > doms = NULL due to a kmalloc failure. This leads to a null-pointer > dereference when accessing doms in rebuild_sched_domains_locked(). > > Fix this by adding a NULL check for doms before accessing it. > > Fixes: 6ee43047e8ad ("cpuset: Remove unnecessary checks in rebuild_sched_domains_locked") > Reported-by: syzbot+460792609a79c085f79f@syzkaller.appspotmail.com > Signed-off-by: Chen Ridong > --- > kernel/cgroup/cpuset.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c > index 9faf34377a88..8ebf2ab8f0df 100644 > --- a/kernel/cgroup/cpuset.c > +++ b/kernel/cgroup/cpuset.c > @@ -962,7 +962,8 @@ void rebuild_sched_domains_locked(void) > * prevent the panic. > */ > for (i = 0; i < ndoms; ++i) { > - if (WARN_ON_ONCE(!cpumask_subset(doms[i], cpu_active_mask))) > + if (doms && WARN_ON_ONCE(!cpumask_subset(doms[i], > + cpu_active_mask))) > return; > } > I would prefer putting the doms check in the for loop without the line wrap, but that will work too. Acked-by: Waiman Long