From 8237cc8693bc26e3949830d6537f5c6b348ba1a0 Mon Sep 17 00:00:00 2001 From: Stephen Dickey Date: Mon, 12 Apr 2021 12:14:15 -0700 Subject: [PATCH] sched/walt: null ptr dereference fix in walt_lb_active_migration It is possible that wrq->push_task is null but walt_lb_active_migration assumes it is non-null. Local variable push_task is used after copying the value, and can be dereferenced. Update walt_lb_active_migration to safely check push_task, and ensure that the active migration flag is cleared. Change-Id: I3b555430f1ba940053756fcbf2cca5c7d19de9fb Signed-off-by: Stephen Dickey --- kernel/sched/walt/walt_lb.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/kernel/sched/walt/walt_lb.c b/kernel/sched/walt/walt_lb.c index 30202177a806..960da0dca5d4 100644 --- a/kernel/sched/walt/walt_lb.c +++ b/kernel/sched/walt/walt_lb.c @@ -45,7 +45,7 @@ static int walt_lb_active_migration(void *data) raw_spin_lock_irq(&busiest_rq->lock); /* sanity checks before initiating the pull */ - if (!cpu_active(busiest_cpu) || !cpu_active(target_cpu)) + if (!cpu_active(busiest_cpu) || !cpu_active(target_cpu) || !push_task) goto out_unlock; if (unlikely(busiest_cpu != raw_smp_processor_id() || @@ -73,15 +73,16 @@ static int walt_lb_active_migration(void *data) raw_spin_unlock(&busiest_rq->lock); if (push_task_detached) { - if (push_task_detached) { - raw_spin_lock(&target_rq->lock); - walt_attach_task(push_task, target_rq); - raw_spin_unlock(&target_rq->lock); - } + raw_spin_lock(&target_rq->lock); + walt_attach_task(push_task, target_rq); + raw_spin_unlock(&target_rq->lock); } - put_task_struct(push_task); + + if (push_task) + put_task_struct(push_task); local_irq_enable(); + return 0; }