Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

sched/mm_cid: Prevent NULL mm dereference in sched_mm_cid_after_execve()

sched_mm_cid_after_execve() is called in bprm_execve()'s cleanup path even
when exec_binprm() fails. For the init task's first execve(), this causes a
problem:

1. current->mm is NULL (kernel threads don't have an mm)
2. sched_mm_cid_before_execve() exits early because mm is NULL
3. exec_binprm() fails (e.g., ENOENT for missing script interpreter)
4. sched_mm_cid_after_execve() is called with mm still NULL
5. sched_mm_cid_fork() is called unconditionally, triggering WARN_ON

This is easily reproduced by booting with an init that is a shell script
(#!/bin/sh) where the interpreter doesn't exist in the initramfs.

Fix this by checking if t->mm is NULL before calling sched_mm_cid_fork(),
matching the behavior of sched_mm_cid_before_execve() which already
handles this case via sched_mm_cid_exit()'s early return.

Fixes: b0c3d51b54f8 ("sched/mmcid: Provide precomputed maximal value")
Signed-off-by: Cong Wang <cwang@multikernel.io>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Reviewed-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Acked-by: Will Deacon <will@kernel.org>
Link: https://patch.msgid.link/20251223215113.639686-1-xiyou.wangcong@gmail.com

authored by

Cong Wang and committed by
Thomas Gleixner
2bdf7774 9ace4753

+3 -2
+3 -2
kernel/sched/core.c
··· 10694 10694 sched_mm_cid_exit(t); 10695 10695 } 10696 10696 10697 - /* Reactivate MM CID after successful execve() */ 10697 + /* Reactivate MM CID after execve() */ 10698 10698 void sched_mm_cid_after_execve(struct task_struct *t) 10699 10699 { 10700 - sched_mm_cid_fork(t); 10700 + if (t->mm) 10701 + sched_mm_cid_fork(t); 10701 10702 } 10702 10703 10703 10704 static void mm_cid_work_fn(struct work_struct *work)