Syzbot found a GPF in reweight_entity. This has been bisected to commit c85c6fadbef0 ("kernel/sched: Fix sched_fork() access an invalid sched_task_group") Looks like after this change there is a time window, when task_struct->se.cfs_rq can be NULL. This can be exploited to trigger null-ptr-deref by calling setpriority on that task.
Cc: Ingo Molnar mingo@redhat.com Cc: Peter Zijlstra peterz@infradead.org Cc: Juri Lelli juri.lelli@redhat.com Cc: Vincent Guittot vincent.guittot@linaro.org Cc: Dietmar Eggemann dietmar.eggemann@arm.com Cc: Steven Rostedt rostedt@goodmis.org Cc: Ben Segall bsegall@google.com Cc: Mel Gorman mgorman@suse.de Cc: Daniel Bristot de Oliveira bristot@redhat.com Cc: Zhang Qiao zhangqiao22@huawei.com Cc: stable@vger.kernel.org Cc: linux-kernel@vger.kernel.org
Link: https://syzkaller.appspot.com/bug?id=9d9c27adc674e3a7932b22b61c79a02da82cbdc... Fixes: c85c6fadbef0 ("kernel/sched: Fix sched_fork() access an invalid sched_task_group") Signed-off-by: Tadeusz Struk tadeusz.struk@linaro.org --- kernel/sched/fair.c | 3 +++ 1 file changed, 3 insertions(+)
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 095b0aa378df..196f8cee3f9b 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -3042,6 +3042,9 @@ dequeue_load_avg(struct cfs_rq *cfs_rq, struct sched_entity *se) { } static void reweight_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, unsigned long weight) { + if (!cfs_rq) + return; + if (se->on_rq) { /* commit outstanding execution time */ if (cfs_rq->curr == se)