Re: [PATCH] sched: Fix NULL pointer dereference in sched_mm_cid_fork()

[Valentin Schneider <vschneid@redhat.com>]

On 30/12/25 06:34, Breno Leitao wrote:
> Function sched_mm_cid_fork() contains a WARN_ON_ONCE() check that
> triggers when mm is NULL, but execution continues regardless, leading to
> a NULL pointer dereference when attempting to lock &mm->mm_cid.mutex.
>
>       Unable to handle kernel NULL pointer dereference at virtual address 00000000000001e0
>       [00000000000001e0] user address but active_mm is swapper
>       Internal error: Oops: 0000000096000005 [#1]  SMP
>       Modules linked in:
>       CPU: 9 UID: 0 PID: 1 Comm: swapper/0 Tainted:
>       pc : __mutex_lock_common
>       Call trace:
>         __mutex_lock_common
>         mutex_lock_nested
>         sched_mm_cid_fork
>         sched_mm_cid_after_execve
>         bprm_execve
>
> This crash can occur during execve() failure paths where
> sched_mm_cid_after_execve() is called with a task that has a NULL mm.
>
> Fix this by making the function return early if the WARN_ON_ONCE()
> condition is true, preventing the NULL pointer dereference.
>
> Signed-off-by: Breno Leitao <leitao@debian.org>
> ---
> I've inadvertently reproduced this bug by booting the kernel with an
> init binary from a different architecture.
>
> Specifically, I cross-compiled the kernel, but the init binary was built
> for an architecture that didn't match the kernel.
>
> With the applied fix, I now see the following line instead of
> experiencing a crash.
>
>    Kernel panic - not syncing: Requested init mybinary failed (error -8)

A slightly different fix is on its way, see:
https://lore.kernel.org/lkml/20251223215113.639686-1-xiyou.wangcong@gmail.com/