Re: [PATCH] sched: Fix NULL mm dereference in sched_mm_cid_after_execve()

[Mathieu Desnoyers]

On 2025-12-23 16:51, Cong Wang wrote:
> From: Cong Wang <cwang@xxxxxxxxxxxxxx>
>
> sched_mm_cid_after_execve() is called in bprm_execve()'s cleanup path
> even when exec_binprm() fails. For the init task's first execve, this
> causes a problem:
>
> 1. current->mm is NULL (kernel threads don't have an mm)
> 2. sched_mm_cid_before_execve() exits early because mm is NULL
> 3. exec_binprm() fails (e.g., ENOENT for missing script interpreter)
> 4. sched_mm_cid_after_execve() is called with mm still NULL
> 5. sched_mm_cid_fork() is called unconditionally, triggering WARN_ON
>
> This is easily reproduced by booting with an init that is a shell script
> (#!/bin/sh) where the interpreter doesn't exist in the initramfs.
>
> Fix this by checking if t->mm is NULL before calling sched_mm_cid_fork(),
> matching the behavior of sched_mm_cid_before_execve() which already
> handles this case via sched_mm_cid_exit()'s early return.
>
> Fixes: b0c3d51b54f8 ("sched/mmcid: Provide precomputed maximal value")
> Cc: Thomas Gleixner <tglx@xxxxxxxxxxxxx>
> Signed-off-by: Cong Wang <cwang@xxxxxxxxxxxxxx>

Thanks for the detailed explanation.

Indeed, the offending commit removes a pre-existing NULL mm check:

 void sched_mm_cid_after_execve(struct task_struct *t)
 {
-       struct mm_struct *mm = t->mm;
-
-       if (!mm)
-               return;

Reviewed-by: Mathieu Desnoyers <mathieu.desnoyers@xxxxxxxxxxxx>

Thomas, Peter, Ingo, can we fast-track this fix for upstream ?

Thanks,

Mathieu

--
Mathieu Desnoyers
EfficiOS Inc.
https://www.efficios.com