[PATCH] sched: Fix NULL pointer dereference in sched_mm_cid_fork()

From: Breno Leitao

Date: Tue Dec 30 2025 - 09:34:27 EST


Function sched_mm_cid_fork() contains a WARN_ON_ONCE() check that
triggers when mm is NULL, but execution continues regardless, leading to
a NULL pointer dereference when attempting to lock &mm->mm_cid.mutex.

Unable to handle kernel NULL pointer dereference at virtual address 00000000000001e0
[00000000000001e0] user address but active_mm is swapper
Internal error: Oops: 0000000096000005 [#1] SMP
Modules linked in:
CPU: 9 UID: 0 PID: 1 Comm: swapper/0 Tainted:
pc : __mutex_lock_common
Call trace:
__mutex_lock_common
mutex_lock_nested
sched_mm_cid_fork
sched_mm_cid_after_execve
bprm_execve

This crash can occur during execve() failure paths where
sched_mm_cid_after_execve() is called with a task that has a NULL mm.

Fix this by making the function return early if the WARN_ON_ONCE()
condition is true, preventing the NULL pointer dereference.

Signed-off-by: Breno Leitao <leitao@xxxxxxxxxx>
---
I've inadvertently reproduced this bug by booting the kernel with an
init binary from a different architecture.

Specifically, I cross-compiled the kernel, but the init binary was built
for an architecture that didn't match the kernel.

With the applied fix, I now see the following line instead of
experiencing a crash.

Kernel panic - not syncing: Requested init mybinary failed (error -8)
---
kernel/sched/core.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 41ba0be16911..eee5181fcc00 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -10566,7 +10566,8 @@ void sched_mm_cid_fork(struct task_struct *t)
struct mm_struct *mm = t->mm;
bool percpu;

- WARN_ON_ONCE(!mm || t->mm_cid.cid != MM_CID_UNSET);
+ if (WARN_ON_ONCE(!mm || t->mm_cid.cid != MM_CID_UNSET))
+ return;

guard(mutex)(&mm->mm_cid.mutex);
scoped_guard(raw_spinlock_irq, &mm->mm_cid.lock) {

---
base-commit: 8640b74557fc8b4c300030f6ccb8cd078f665ec8
change-id: 20251230-sched-44236f6178af

Best regards,
--
Breno Leitao <leitao@xxxxxxxxxx>