Messages in this thread | | | From | Vincent Guittot <> | Date | Wed, 19 Jan 2022 10:08:25 +0100 | Subject | Re: [PATCH] sched/fair: Fix fault in reweight_entity |
| |
On Wed, 19 Jan 2022 at 02:24, Tadeusz Struk <tadeusz.struk@linaro.org> wrote: > > Syzbot found a GPF in reweight_entity. This has been bisected to commit > c85c6fadbef0 ("kernel/sched: Fix sched_fork() access an invalid sched_task_group") > Looks like after this change there is a time window, when > task_struct->se.cfs_rq can be NULL. This can be exploited to trigger > null-ptr-deref by calling setpriority on that task. > > Cc: Ingo Molnar <mingo@redhat.com> > Cc: Peter Zijlstra <peterz@infradead.org> > Cc: Juri Lelli <juri.lelli@redhat.com> > Cc: Vincent Guittot <vincent.guittot@linaro.org> > Cc: Dietmar Eggemann <dietmar.eggemann@arm.com> > Cc: Steven Rostedt <rostedt@goodmis.org> > Cc: Ben Segall <bsegall@google.com> > Cc: Mel Gorman <mgorman@suse.de> > Cc: Daniel Bristot de Oliveira <bristot@redhat.com> > Cc: Zhang Qiao <zhangqiao22@huawei.com> > Cc: stable@vger.kernel.org > Cc: linux-kernel@vger.kernel.org > > Link: https://syzkaller.appspot.com/bug?id=9d9c27adc674e3a7932b22b61c79a02da82cbdc1 > Fixes: c85c6fadbef0 ("kernel/sched: Fix sched_fork() access an invalid sched_task_group")
The sha1 doesn't look correct.
> Signed-off-by: Tadeusz Struk <tadeusz.struk@linaro.org> > --- > kernel/sched/fair.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c > index 095b0aa378df..196f8cee3f9b 100644 > --- a/kernel/sched/fair.c > +++ b/kernel/sched/fair.c > @@ -3042,6 +3042,9 @@ dequeue_load_avg(struct cfs_rq *cfs_rq, struct sched_entity *se) { } > static void reweight_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, > unsigned long weight) > { > + if (!cfs_rq) > + return; > + > if (se->on_rq) { > /* commit outstanding execution time */ > if (cfs_rq->curr == se) > -- > 2.34.1 >
| |