Re: [PATCH v2 sched_ext/for-7.3 15/36] sched_ext: Add scx_cmask_ref for validated arena cmask access

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Non-atomic Read-Modify-Write in `scx_cmask_ref_or` and `scx_cmask_ref_copy` clobbers concurrent BPF updates to adjacent bits.
--

commit 1141e7d64b0f45ca499fc3944be4ed4e896ff3b8
Author: Tejun Heo <tj@kernel.org>

sched_ext: Add scx_cmask_ref for validated arena cmask access

This commit introduces scx_cmask_ref to safely validate and access BPF
arena memory used for struct scx_cmask. It takes a snapshot of the base
and nr_cids to protect against concurrent BPF mutations, and provides bounded
shard read and writeback functions like scx_cmask_ref_or() and
scx_cmask_ref_copy().

> diff --git a/kernel/sched/ext/cid.c b/kernel/sched/ext/cid.c
> index 6a22bead4c601..42fc8348b3b4c 100644
> --- a/kernel/sched/ext/cid.c
> +++ b/kernel/sched/ext/cid.c

[ ... ]

> @@ -669,6 +675,12 @@ static __always_inline bool cmask_word_op2(u64 *av, const u64 *bp, u64 mask,
>  		return (READ_ONCE(*bp) & ~READ_ONCE(*av)) & mask;
>  	case CMASK_OP2_INTERSECTS:
>  		return (READ_ONCE(*av) & READ_ONCE(*bp)) & mask;
> +	case CMASK_OP2_REF_OR:
> +		WRITE_ONCE(*av, READ_ONCE(*av) | (READ_ONCE(*bp) & mask));
> +		return false;
> +	case CMASK_OP2_REF_COPY:
> +		WRITE_ONCE(*av, (READ_ONCE(*av) & ~mask) | (READ_ONCE(*bp) & mask));

[Severity: High]
Does this non-atomic read-modify-write clobber concurrent BPF updates to
adjacent bits?

Since this code uses READ_ONCE() and WRITE_ONCE() but performs a
read-modify-write sequence, if a BPF program concurrently updates other bits
in the same 64-bit word (for example, using atomic bit operations), could
those updates be lost when this kernel thread writes back the modified word?

Would a cmpxchg loop or a proper atomic bitwise operation be necessary here
to prevent data loss under concurrency?

> +		return false;
>  	}
>  	unreachable();
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260706014058.439853-1-tj@kernel.org?part=15