build_overlap_sched_groups() can complete without creating any sched_group
and still return success.
This can happen on overlapping NUMA topologies with unequal domain depth.
In that case build_sched_domains() may stop building some sibling domain
levels early once their span already matches the target cpu_map. Later,
when build_overlap_sched_groups() walks the span, every candidate sibling
can fail the:
cpumask_test_cpu(i, sched_domain_span(sibling))
check, so no group is created and first remains NULL.
That leaves sd->groups unset (NULL). Later topology setup still assumes
sd->groups is valid and can dereference it from
init_sched_groups_capacity(), sd_degenerate(), and cpu_attach_domain().
Catch the empty-group case in build_overlap_sched_groups() itself and
fail the sched-domain build through the existing error path instead of
constructing an invalid sched_domain.
Fixes: f2cb13609d53 ("sched/topology: Split out scheduler topology code from core.c into topology.c")
Cc: stable@vger.kernel.org
Assisted-by: Codex:GPT-5
Signed-off-by: Joseph Salisbury <joseph.salisbury@oracle.com>
---
kernel/sched/topology.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c
--- a/kernel/sched/topology.c
+++ b/kernel/sched/topology.c
@@ -1108,6 +1108,10 @@ build_overlap_sched_groups(struct sched_domain *sd, int cpu)
last = sg;
last->next = first;
}
+
+ if (WARN_ON_ONCE(!first))
+ return -EINVAL;
+
sd->groups = first;
return 0;
--
2.47.3