Messages in this thread Patch in this message | | | From | Tadeusz Struk <> | Subject | [PATCH] sched/fair: Fix fault in reweight_entity | Date | Tue, 18 Jan 2022 17:24:17 -0800 |
| |
Syzbot found a GPF in reweight_entity. This has been bisected to commit c85c6fadbef0 ("kernel/sched: Fix sched_fork() access an invalid sched_task_group") Looks like after this change there is a time window, when task_struct->se.cfs_rq can be NULL. This can be exploited to trigger null-ptr-deref by calling setpriority on that task.
Cc: Ingo Molnar <mingo@redhat.com> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Juri Lelli <juri.lelli@redhat.com> Cc: Vincent Guittot <vincent.guittot@linaro.org> Cc: Dietmar Eggemann <dietmar.eggemann@arm.com> Cc: Steven Rostedt <rostedt@goodmis.org> Cc: Ben Segall <bsegall@google.com> Cc: Mel Gorman <mgorman@suse.de> Cc: Daniel Bristot de Oliveira <bristot@redhat.com> Cc: Zhang Qiao <zhangqiao22@huawei.com> Cc: stable@vger.kernel.org Cc: linux-kernel@vger.kernel.org
Link: https://syzkaller.appspot.com/bug?id=9d9c27adc674e3a7932b22b61c79a02da82cbdc1 Fixes: c85c6fadbef0 ("kernel/sched: Fix sched_fork() access an invalid sched_task_group") Signed-off-by: Tadeusz Struk <tadeusz.struk@linaro.org> --- kernel/sched/fair.c | 3 +++ 1 file changed, 3 insertions(+)
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 095b0aa378df..196f8cee3f9b 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -3042,6 +3042,9 @@ dequeue_load_avg(struct cfs_rq *cfs_rq, struct sched_entity *se) { } static void reweight_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, unsigned long weight) { + if (!cfs_rq) + return; + if (se->on_rq) { /* commit outstanding execution time */ if (cfs_rq->curr == se) -- 2.34.1
| |