Commit 2bdf7774 authored by Cong Wang's avatar Cong Wang Committed by Thomas Gleixner
Browse files

sched/mm_cid: Prevent NULL mm dereference in sched_mm_cid_after_execve()



sched_mm_cid_after_execve() is called in bprm_execve()'s cleanup path even
when exec_binprm() fails. For the init task's first execve(), this causes a
problem:

  1. current->mm is NULL (kernel threads don't have an mm)
  2. sched_mm_cid_before_execve() exits early because mm is NULL
  3. exec_binprm() fails (e.g., ENOENT for missing script interpreter)
  4. sched_mm_cid_after_execve() is called with mm still NULL
  5. sched_mm_cid_fork() is called unconditionally, triggering WARN_ON

This is easily reproduced by booting with an init that is a shell script
(#!/bin/sh) where the interpreter doesn't exist in the initramfs.

Fix this by checking if t->mm is NULL before calling sched_mm_cid_fork(),
matching the behavior of sched_mm_cid_before_execve() which already
handles this case via sched_mm_cid_exit()'s early return.

Fixes: b0c3d51b ("sched/mmcid: Provide precomputed maximal value")
Signed-off-by: default avatarCong Wang <cwang@multikernel.io>
Signed-off-by: default avatarThomas Gleixner <tglx@kernel.org>
Reviewed-by: default avatarMathieu Desnoyers <mathieu.desnoyers@efficios.com>
Acked-by: default avatarWill Deacon <will@kernel.org>
Link: https://patch.msgid.link/20251223215113.639686-1-xiyou.wangcong@gmail.com
parent 9ace4753
Loading
Loading
Loading
Loading
+3 −2
Original line number Diff line number Diff line
@@ -10694,9 +10694,10 @@ void sched_mm_cid_before_execve(struct task_struct *t)
	sched_mm_cid_exit(t);
}

/* Reactivate MM CID after successful execve() */
/* Reactivate MM CID after execve() */
void sched_mm_cid_after_execve(struct task_struct *t)
{
	if (t->mm)
		sched_mm_cid_fork(t);
}