[PATCH] sched: Fix NULL mm dereference in sched_mm_cid_after_execve()

[Cong Wang]

From: Cong Wang <cwang@xxxxxxxxxxxxxx>

sched_mm_cid_after_execve() is called in bprm_execve()'s cleanup path
even when exec_binprm() fails. For the init task's first execve, this
causes a problem:

1. current->mm is NULL (kernel threads don't have an mm)
2. sched_mm_cid_before_execve() exits early because mm is NULL
3. exec_binprm() fails (e.g., ENOENT for missing script interpreter)
4. sched_mm_cid_after_execve() is called with mm still NULL
5. sched_mm_cid_fork() is called unconditionally, triggering WARN_ON

This is easily reproduced by booting with an init that is a shell script
(#!/bin/sh) where the interpreter doesn't exist in the initramfs.

Fix this by checking if t->mm is NULL before calling sched_mm_cid_fork(),
matching the behavior of sched_mm_cid_before_execve() which already
handles this case via sched_mm_cid_exit()'s early return.

Fixes: b0c3d51b54f8 ("sched/mmcid: Provide precomputed maximal value")
Cc: Thomas Gleixner <tglx@xxxxxxxxxxxxx>
Signed-off-by: Cong Wang <cwang@xxxxxxxxxxxxxx>
---
 kernel/sched/core.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 41ba0be16911..60afadb6eede 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -10694,10 +10694,11 @@ void sched_mm_cid_before_execve(struct task_struct *t)
 	sched_mm_cid_exit(t);
 }
 
-/* Reactivate MM CID after successful execve() */
+/* Reactivate MM CID after execve() */
 void sched_mm_cid_after_execve(struct task_struct *t)
 {
-	sched_mm_cid_fork(t);
+	if (t->mm)
+		sched_mm_cid_fork(t);
 }
 
 static void mm_cid_work_fn(struct work_struct *work)
-- 
2.34.1