Re: [PATCH v3 sched_ext/for-7.3 19/36] sched_ext: Add per-shard cap delegation for sub-schedulers

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Missing bounds check on the shard index `si` against `target->nr_pshards` in `scx_bpf_sub_caps()` leads to an out-of-bounds array access on the `pshard` array.
--

--- Patch [19]: [PATCH v3 sched_ext/for-7.3 19/36] sched_ext: Add per-shard cap delegation for sub-schedulers ---
commit 4ef150e106489066d9726027ae3dce353775a7d4
Author: Tejun Heo <tj@kernel.org>

sched_ext: Add per-shard cap delegation for sub-schedulers

This commit introduces the framework for per-shard capability delegation
for sub-schedulers in sched_ext. It allows parents to grant or revoke
capabilities per-cid locally via scx_bpf_sub_grant() and related functions.

> diff --git a/kernel/sched/ext/sub.c b/kernel/sched/ext/sub.c
> --- a/kernel/sched/ext/sub.c
> +++ b/kernel/sched/ext/sub.c

[ ... ]

> @@ -737,6 +799,284 @@ __bpf_kfunc bool scx_bpf_sub_dispatch(u64 cgroup_id, const struct bpf_prog_aux *

[ ... ]

> +__bpf_kfunc s32 scx_bpf_sub_caps(u64 cgroup_id, u64 caps, struct scx_cmask *out__ign,
> +				 const struct bpf_prog_aux *aux)
> +{

[ ... ]

> +	for (si = ref.shard_first; si < ref.shard_end; si++) {
> +		const struct scx_cid_shard *shard = &scx_cid_shard_ranges[si];
> +		SCX_CMASK_DEFINE_SHARD(local_out, shard->base_cid, shard->nr_cids);
> +		u32 cap_bit;
> +
> +		scx_for_each_cap_bit(cap_bit, caps)
> +			scx_cmask_or(local_out, &pshard[si]->caps[cap_bit].cmask);

[Severity: High]
Is it possible for si to exceed the bounds of the pshard array here?

If an old root scheduler is unlinked but its BPF programs are kept alive
by a user-space held file descriptor, those programs can execute later.
If a new root scheduler is subsequently loaded and uses scx_bpf_cid_override()
to increase the global scx_nr_cid_shards, ref.shard_end (which tracks the
global layout) will reflect this new, larger value.

When the old scheduler's BPF program calls scx_bpf_sub_caps(), this loop
could iterate past the size of its originally allocated pshard array, causing
an out-of-bounds pointer read when accessing pshard[si]. Should this loop
bounds check si against target->nr_pshards to prevent this?

> +		scx_cmask_ref_copy(&ref, local_out);
> +	}
> +	return 0;
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260707001229.1410929-1-tj@kernel.org?part=19