Re: [tip:sched/core] [sched/fair] 79104becf4: BUG:kernel_NULL_pointer_dereference,address

["Chen, Yu C" <yu.c.chen@intel.com>]

On 10/21/2025 1:14 PM, kernel test robot wrote:
> 
> 
> Hello,
> 
> kernel test robot noticed "BUG:kernel_NULL_pointer_dereference,address" on:
> 
> commit: 79104becf42baeeb4a3f2b106f954b9fc7c10a3c ("sched/fair: Forfeit vruntime on yield")
> https://git.kernel.org/cgit/linux/kernel/git/tip/tip.git sched/core
> 
> [   23.486344][ T3682] BUG: kernel NULL pointer dereference, address: 0000000000000051
> [   23.486846][ T3682] #PF: supervisor read access in kernel mode
> [   23.487189][ T3682] #PF: error_code(0x0000) - not-present page
> [   23.487532][ T3682] PGD 12b0a5067 P4D 12b0a5067 PUD 12b0b0067 PMD 0
> [   23.487905][ T3682] Oops: Oops: 0000 [#1]
> [   23.488147][ T3682] CPU: 0 UID: 65534 PID: 3682 Comm: trinity-c1 Not tainted 6.18.0-rc1-00001-g79104becf42b #1 PREEMPT
> [   23.488817][ T3682] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
> [   23.489401][ T3682] RIP: 0010:pick_task_fair (kernel/sched/fair.c:5526 kernel/sched/fair.c:8846)

Take a glance at the context, it seems to break here:
pick_next_entity(rq, cfs_rq)
   se = pick_eevdf(cfs_rq);
     se->sched_delayed   <=== se is NULL

In the original change, we force the current running
  se's vruntime moving forward and I guess for some
reason the corresponding cfs_rq->min_vruntime moves
forward too. Thus the rest se in the cfs_rq become
ineligible, and pick_eevdf() return NULL.

thanks,
Chenyu