Re: [PATCH] sched: Fix NULL mm dereference in sched_mm_cid_after_execve()

[Will Deacon <will@kernel.org>]

On Tue, Dec 23, 2025 at 01:51:13PM -0800, Cong Wang wrote:
> From: Cong Wang <cwang@multikernel.io>
> 
> sched_mm_cid_after_execve() is called in bprm_execve()'s cleanup path
> even when exec_binprm() fails. For the init task's first execve, this
> causes a problem:
> 
> 1. current->mm is NULL (kernel threads don't have an mm)
> 2. sched_mm_cid_before_execve() exits early because mm is NULL
> 3. exec_binprm() fails (e.g., ENOENT for missing script interpreter)
> 4. sched_mm_cid_after_execve() is called with mm still NULL
> 5. sched_mm_cid_fork() is called unconditionally, triggering WARN_ON
> 
> This is easily reproduced by booting with an init that is a shell script
> (#!/bin/sh) where the interpreter doesn't exist in the initramfs.
> 
> Fix this by checking if t->mm is NULL before calling sched_mm_cid_fork(),
> matching the behavior of sched_mm_cid_before_execve() which already
> handles this case via sched_mm_cid_exit()'s early return.
> 
> Fixes: b0c3d51b54f8 ("sched/mmcid: Provide precomputed maximal value")
> Cc: Thomas Gleixner <tglx@linutronix.de>
> Signed-off-by: Cong Wang <cwang@multikernel.io>
> ---
>  kernel/sched/core.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/kernel/sched/core.c b/kernel/sched/core.c
> index 41ba0be16911..60afadb6eede 100644
> --- a/kernel/sched/core.c
> +++ b/kernel/sched/core.c
> @@ -10694,10 +10694,11 @@ void sched_mm_cid_before_execve(struct task_struct *t)
>  	sched_mm_cid_exit(t);
>  }
>  
> -/* Reactivate MM CID after successful execve() */
> +/* Reactivate MM CID after execve() */
>  void sched_mm_cid_after_execve(struct task_struct *t)
>  {
> -	sched_mm_cid_fork(t);
> +	if (t->mm)
> +		sched_mm_cid_fork(t);
>  }
>  
>  static void mm_cid_work_fn(struct work_struct *work)

This addresses a panic reported on arm64 when trying to execute x86
binaries using TCG on an Apple device:

https://lore.kernel.org/all/20251226192506.88593-1-za4emsu@gmail.com/

so:

Acked-by: Will Deacon <will@kernel.org>

Please can we land this for 6.19?

Cheers,

Will