[PATCH] sched: Fix NULL pointer dereference in sched_mm_cid_fork()
From: Breno Leitao
Date: Tue Dec 30 2025 - 09:34:27 EST
Function sched_mm_cid_fork() contains a WARN_ON_ONCE() check that
triggers when mm is NULL, but execution continues regardless, leading to
a NULL pointer dereference when attempting to lock &mm->mm_cid.mutex.
Unable to handle kernel NULL pointer dereference at virtual address 00000000000001e0
[00000000000001e0] user address but active_mm is swapper
Internal error: Oops: 0000000096000005 [#1] SMP
Modules linked in:
CPU: 9 UID: 0 PID: 1 Comm: swapper/0 Tainted:
pc : __mutex_lock_common
Call trace:
__mutex_lock_common
mutex_lock_nested
sched_mm_cid_fork
sched_mm_cid_after_execve
bprm_execve
This crash can occur during execve() failure paths where
sched_mm_cid_after_execve() is called with a task that has a NULL mm.
Fix this by making the function return early if the WARN_ON_ONCE()
condition is true, preventing the NULL pointer dereference.
Signed-off-by: Breno Leitao <leitao@xxxxxxxxxx>
---
I've inadvertently reproduced this bug by booting the kernel with an
init binary from a different architecture.
Specifically, I cross-compiled the kernel, but the init binary was built
for an architecture that didn't match the kernel.
With the applied fix, I now see the following line instead of
experiencing a crash.
Kernel panic - not syncing: Requested init mybinary failed (error -8)
---
kernel/sched/core.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 41ba0be16911..eee5181fcc00 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -10566,7 +10566,8 @@ void sched_mm_cid_fork(struct task_struct *t)
struct mm_struct *mm = t->mm;
bool percpu;
- WARN_ON_ONCE(!mm || t->mm_cid.cid != MM_CID_UNSET);
+ if (WARN_ON_ONCE(!mm || t->mm_cid.cid != MM_CID_UNSET))
+ return;
guard(mutex)(&mm->mm_cid.mutex);
scoped_guard(raw_spinlock_irq, &mm->mm_cid.lock) {
---
base-commit: 8640b74557fc8b4c300030f6ccb8cd078f665ec8
change-id: 20251230-sched-44236f6178af
Best regards,
--
Breno Leitao <leitao@xxxxxxxxxx>