pick_next_task_fair空指针访问宕机

> _**请尽量提供详细的信息，如缺乏必要的定位信息，则缺陷不会被定位**_

## 环境信息

【OS版本】（如openEuler-22.03-LTS，参考命令"cat /etc/os-release"结果）
openeuler-2403-lts

【内核版本】（如kernel-5.10.0-60.138.0.165，参考命令"uname -r"结果）
6.6.0-85.0.0.90

【硬件平台】（缺陷相关的硬件信息，如：处理器型号、内存、磁盘、网卡、BIOS 等信息）
x86

【组网信息】（和网络、性能相关的问题，应该说明详细的组网和场景信息）

## 缺陷信息

[226790.046558] general protection fault, probably for non-canonical address 0xdffffc0000000014: 0000 [#1] SMP KASAN NOPTI
[226790.046690] KASAN: null-ptr-deref in range [0x00000000000000a0-0x00000000000000a7]
[226790.046763] CPU: 12 PID: 23939 Comm: sleep Kdump: loaded Tainted: G S         OE      6.6.0-85.0.0.90.sfc.6.0.0.x86_64+debug #1
[226790.046876] Hardware name: SANGFOR 60G24-SG/VDS-3550, BIOS 004 10/28/2016
[226790.046939] RIP: 0010:pick_next_task_fair+0x801/0x22c0
[226790.047001] Code: 00 4c 89 f7 e8 c0 c4 fd ff 84 c0 0f 85 84 fd ff ff 4c 89 f7 e8 c0 99 fe ff 4c 8d a8 a0 00 00 00 49 89 c4 4
c 89 e8 48 c1 e8 03 <80> 3c 28 00 0f 85 b8 12 00 00 4d 8b b4 24 a0 00 00 00 4c 89 f7 e8
[226790.047161] RSP: 0018:ffff88894f4b6478 EFLAGS: 00010006
[226790.047218] RAX: 0000000000000014 RBX: dffffc0000000000 RCX: 1ffff11084cf5d0d
[226790.047284] RDX: 8068e4a5549d50b3 RSI: ffff88875d1137c0 RDI: ffff88875d1137d8
[226790.047352] RBP: dffffc0000000000 R08: 0000000000015fe9 R09: 1ffff11084cf5d0d
[226790.047419] R10: 0000000000000130 R11: 000000000004de08 R12: 0000000000000000
[226790.047485] R13: 00000000000000a0 R14: ffff88902ff44ec0 R15: ffff88902ff44e40
[226790.047551] FS:  00007f19890a8740(0000) GS:ffff88902ff00000(0000) knlGS:0000000000000000
[226790.047626] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[226790.047682] CR2: 000000c00060a000 CR3: 00000007a5f4c005 CR4: 00000000001706e0
[226790.047749] Call Trace:
[226790.047780]  <TASK>
[226790.047809]  ? die_addr+0x3c/0xa0
[226790.047853]  ? exc_general_protection+0x123/0x230
[226790.047907]  ? asm_exc_general_protection+0x22/0x30
[226790.047961]  ? pick_next_task_fair+0x801/0x22c0
[226790.048009]  ? pick_next_task_fair+0x7f0/0x22c0
[226790.048057]  __schedule+0x4f2/0x1f50
[226790.048098]  ? __pfx___schedule+0x10/0x10
[226790.048142]  ? __blk_flush_plug+0x27a/0x4d0
[226790.048189]  ? __pfx___blk_flush_plug+0x10/0x10
[226790.048236]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10
[226790.048290]  ? pageout+0x2a8/0x820
[226790.048330]  ? __pfx___blk_flush_plug+0x10/0x10
[226790.048377]  ? shrink_node_memcgs+0x2f8/0x6c0
[226790.048425]  ? shrink_node+0x214/0x12d0
[226790.048468]  ? shrink_zones.constprop.0+0x218/0xc30
[226790.050213]  ? __pfx_wbt_io_acct_cb+0x10/0x10
[226790.051976]  schedule+0x129/0x2e0

crash> bt
Detaching after fork from child process 3935.
PID: 23939    TASK: ffff888c1d2a8000  CPU: 12   COMMAND: "sleep"
 #0 [ffff88894f4b6090] machine_kexec at ffffffff95d3c7ea
 #1 [ffff88894f4b6190] __crash_kexec at ffffffff960be975
 #2 [ffff88894f4b62e8] crash_kexec at ffffffff960c1743
 #3 [ffff88894f4b6300] oops_end at ffffffff95c96477
 #4 [ffff88894f4b6320] exc_general_protection at ffffffff9839b113
 #5 [ffff88894f4b63c0] asm_exc_general_protection at ffffffff98400b52
    [exception RIP: pick_next_task_fair+2049]
    RIP: ffffffff95f31fb1  RSP: ffff88894f4b6478  RFLAGS: 00010006
    RAX: 0000000000000014  RBX: dffffc0000000000  RCX: 1ffff11084cf5d0d
    RDX: 8068e4a5549d50b3  RSI: ffff88875d1137c0  RDI: ffff88875d1137d8
    RBP: dffffc0000000000   R8: 0000000000015fe9   R9: 1ffff11084cf5d0d
    R10: 0000000000000130  R11: 000000000004de08  R12: 0000000000000000
    R13: 00000000000000a0  R14: ffff88902ff44ec0  R15: ffff88902ff44e40
    ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
 #6 [ffff88894f4b64f8] __schedule at ffffffff983ac142
 #7 [ffff88894f4b6618] schedule at ffffffff983adcd9
 #8 [ffff88894f4b6640] io_schedule at ffffffff983ae413
 #9 [ffff88894f4b6658] rq_qos_wait at ffffffff96d3e721
#10 [ffff88894f4b6760] wbt_wait at ffffffff96dc58ae
#11 [ffff88894f4b6810] __rq_qos_throttle at ffffffff96d3dcd9
#12 [ffff88894f4b6838] blk_mq_submit_bio at ffffffff96d0e5ca
#13 [ffff88894f4b6948] submit_bio_noacct_nocheck at ffffffff96ccdb3d
#14 [ffff88894f4b6a10] swap_writepage at ffffffff9665d7f1
#15 [ffff88894f4b6a28] pageout at ffffffff964c8ba8
#16 [ffff88894f4b6b50] shrink_folio_list at ffffffff964e2e16
#17 [ffff88894f4b6ea8] shrink_inactive_list at ffffffff964e961d
#18 [ffff88894f4b6ff8] shrink_lruvec at ffffffff964ede1e
#19 [ffff88894f4b71c8] shrink_node_memcgs at ffffffff964ee588
#20 [ffff88894f4b7248] shrink_node at ffffffff964f3b14
#21 [ffff88894f4b73b0] shrink_zones.constprop.0 at ffffffff964f63c8
#22 [ffff88894f4b74a8] do_try_to_free_pages at ffffffff964f6f10
#23 [ffff88894f4b7548] try_to_free_pages at ffffffff964f81b8
#24 [ffff88894f4b7660] __alloc_pages at ffffffff9663ac50
#25 [ffff88894f4b7868] __folio_alloc at ffffffff9663dbd1
#26 [ffff88894f4b7878] vma_alloc_folio at ffffffff966affb2
#27 [ffff88894f4b7930] __read_swap_cache_async at ffffffff96661558
#28 [ffff88894f4b7a18] swap_vma_readahead at ffffffff96661e96
#29 [ffff88894f4b7b88] do_swap_page at ffffffff9659cc8d
#30 [ffff88894f4b7cf0] __handle_mm_fault at ffffffff965a11ed
#31 [ffff88894f4b7e98] handle_mm_fault at ffffffff965a1d92
#32 [ffff88894f4b7ef0] exc_page_fault at ffffffff9839efae
#33 [ffff88894f4b7f50] asm_exc_page_fault at ffffffff98400c12
    RIP: 00007f198913c327  RSP: 00007ffe2b1f3550  RFLAGS: 00010246
    RAX: 0000000000000000  RBX: 00007f19892975c0  RCX: 0000000000000000
    RDX: 0000000000000000  RSI: 0000000000000000  RDI: 00007f1989298710
    RBP: 0000000000000000   R8: 0000000000000000   R9: 0000000000000000
    R10: 00007ffe2b1f3590  R11: 0000000000000202  R12: 0000000000000000
    R13: 0000555b5467fad0  R14: 000000000000000b  R15: 00007f1989297fc0
    ORIG_RAX: ffffffffffffffff  CS: 0033  SS: 002b
crash>

【实际结果】请描述出问题的结果和影响
空指针访问导致宕机

【期望结果】请描述出期望的结果和影响
正常

【其他相关附件信息】比如 syslog、dmesg、panic、lockup、kdump 信息、图片等

```
# 这里可以附上相关文本信息
```

【已分析信息】如已经做过分析和定位，请尽量附上详细的分析结果

**二、缺陷分析结构反馈**
影响性分析说明：

缺陷严重等级:(Critical/High/Moderate/Low)

缺陷根因说明:

受影响版本排查(受影响/不受影响):
openEuler-20.03-LTS-SP4
openEuler-22.03-LTS-SP3
openEuler-22.03-LTS-SP4
openEuler-24.03-LTS
openEuler-24.03-LTS-SP1

修复是否涉及abi变化(是/否):
openEuler-20.03-LTS-SP4
openEuler-22.03-LTS-SP3
openEuler-22.03-LTS-SP4
openEuler-24.03-LTS
openEuler-24.03-LTS-SP1

GVP openEuler/kernel

内容风险标识

评论 (8)

GVPopenEuler/kernel

内容风险标识