Re: [PATCH] sched: Fix NULL mm dereference in sched_mm_cid_after_execve()

[Mathieu Desnoyers]

On 2026-01-07 13:00, Will Deacon wrote:
> On Tue, Dec 23, 2025 at 01:51:13PM -0800, Cong Wang wrote:
> > From: Cong Wang <cwang@xxxxxxxxxxxxxx>
> >
> > sched_mm_cid_after_execve() is called in bprm_execve()'s cleanup path
> > even when exec_binprm() fails. For the init task's first execve, this
> > causes a problem:
> >
> > 1. current->mm is NULL (kernel threads don't have an mm)
> > 2. sched_mm_cid_before_execve() exits early because mm is NULL
> > 3. exec_binprm() fails (e.g., ENOENT for missing script interpreter)
> > 4. sched_mm_cid_after_execve() is called with mm still NULL
> > 5. sched_mm_cid_fork() is called unconditionally, triggering WARN_ON
> >
> > This is easily reproduced by booting with an init that is a shell script
> > (#!/bin/sh) where the interpreter doesn't exist in the initramfs.
> >
> > Fix this by checking if t->mm is NULL before calling sched_mm_cid_fork(),
> > matching the behavior of sched_mm_cid_before_execve() which already
> > handles this case via sched_mm_cid_exit()'s early return.
> >
> > Fixes: b0c3d51b54f8 ("sched/mmcid: Provide precomputed maximal value")
> > Cc: Thomas Gleixner <tglx@xxxxxxxxxxxxx>
> > Signed-off-by: Cong Wang <cwang@xxxxxxxxxxxxxx>
> > ---
> >   kernel/sched/core.c | 5 +++--
> >   1 file changed, 3 insertions(+), 2 deletions(-)
> >
> > diff --git a/kernel/sched/core.c b/kernel/sched/core.c
> > index 41ba0be16911..60afadb6eede 100644
> > --- a/kernel/sched/core.c
> > +++ b/kernel/sched/core.c
> > @@ -10694,10 +10694,11 @@ void sched_mm_cid_before_execve(struct task_struct *t)
> >   	sched_mm_cid_exit(t);
> >   }
> >   
> > -/* Reactivate MM CID after successful execve() */
> > +/* Reactivate MM CID after execve() */
> >   void sched_mm_cid_after_execve(struct task_struct *t)
> >   {
> > -	sched_mm_cid_fork(t);
> > +	if (t->mm)
> > +		sched_mm_cid_fork(t);
> >   }
> >   
> >   static void mm_cid_work_fn(struct work_struct *work)
>
> This addresses a panic reported on arm64 when trying to execute x86
> binaries using TCG on an Apple device:
>
> https://lore.kernel.org/all/20251226192506.88593-1-za4emsu@xxxxxxxxx/
>
> so:
>
> Acked-by: Will Deacon <will@xxxxxxxxxx>
>
> Please can we land this for 6.19?

Yes, please. I gave my Reviewed-by already 2 weeks ago:

https://lore.kernel.org/lkml/d6ac8fe9-5fc0-4042-9592-cde3db82b65e@xxxxxxxxxxxx/

I guess the relevant maintainers are gradually coming back from the holiday break.
I will ask it again here: can we fast-track this fix for upstream ?

Thanks,

Mathieu

> Cheers,
>
> Will


--
Mathieu Desnoyers
EfficiOS Inc.
https://www.efficios.com