From: Tim Chen <tim.c.chen@linux.intel.com>
To: Yafang Shao <laoar.shao@gmail.com>,
ast@kernel.org, daniel@iogearbox.net, andrii@kernel.org,
eddyz87@gmail.com, memxor@gmail.com, mingo@redhat.com,
peterz@infradead.org, juri.lelli@redhat.com,
vincent.guittot@linaro.org, akpm@linux-foundation.org,
david@kernel.org, gourry@gourry.net, tj@kernel.org,
hannes@cmpxchg.org, mkoutny@suse.com, shakeel.butt@linux.dev,
roman.gushchin@linux.dev, yu.c.chen@intel.com,
zhao1.liu@intel.com, lizhe.67@bytedance.com
Cc: bpf@vger.kernel.org, linux-mm@kvack.org, cgroups@vger.kernel.org,
linux-kernel@vger.kernel.org, stable@vger.kernel.org
Subject: Re: [RFC PATCH v3 bpf-next 1/5] sched: fix stale get_pref_llc() stub for !CONFIG_SCHED_CACHE
Date: Wed, 21 Oct 2026 13:40:01 -0700 [thread overview]
Message-ID: <cbf93381e02861620b012ace93c816f2c0822fea.camel@linux.intel.com> (raw)
In-Reply-To: <20261019064157.29885-2-laoar.shao@gmail.com>
On Mon, 2026-10-19 at 14:41 +0800, Yafang Shao wrote:
> Commit b636fef85bda ("sched/cache: Introduce task_struct->sched_cache_grp
> to fix UAF") switched get_pref_llc() from taking a struct mm_struct * to
> taking the task's struct sched_cache_group *, but only updated the
> CONFIG_SCHED_CACHE definition and its caller: the stub in the
> !CONFIG_SCHED_CACHE branch kept the old mm_struct parameter.
>
> Fixes: b636fef85bda ("sched/cache: Introduce task_struct->sched_cache_grp to fix UAF")
Cc: <stable@vger.kernel.org> #v7.2.x
> Signed-off-by: Yafang Shao <laoar.shao@gmail.com>
> Cc: Tim Chen <tim.c.chen@linux.intel.com>
> Cc: Chen Yu <yu.c.chen@intel.com>
> ---
> kernel/sched/fair.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
> index 57360f5cdde4..973647ad6c2d 100644
> --- a/kernel/sched/fair.c
> +++ b/kernel/sched/fair.c
> @@ -2194,7 +2194,7 @@ void init_sched_mm(struct task_struct *p) { }
> static void task_tick_cache(struct rq *rq, struct task_struct *p) { }
>
> static inline int get_pref_llc(struct task_struct *p,
> - struct mm_struct *mm)
> + struct sched_cache_group *grp)
> {
> return -1;
> }
Thanks for catching it.
Should be backported to 7.2.x kernel as commit b636fef85bda
that this patch fixes has been backported to stable.
Reviewed-by: Tim Chen <tim.c.chen@linux.intel.com>
Tim
next prev parent reply other threads:[~2026-10-21 20:40 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-19 6:41 [RFC PATCH v3 bpf-next 0/5] BPF-based per-cgroup NUMA balancing mode selection Yafang Shao
2026-10-19 6:41 ` [RFC PATCH v3 bpf-next 1/5] sched: fix stale get_pref_llc() stub for !CONFIG_SCHED_CACHE Yafang Shao
2026-10-21 2:23 ` Gregory Price (Meta)
2026-10-21 5:46 ` Yafang Shao
2026-10-21 2:40 ` Chen Yu
2026-10-21 20:40 ` Tim Chen [this message]
2026-10-19 6:41 ` [RFC PATCH v3 bpf-next 2/5] sched: use static_branch_likely() for the NUMA balancing tick check Yafang Shao
2026-10-21 2:26 ` Gregory Price (Meta)
2026-10-19 6:41 ` [RFC PATCH v3 bpf-next 3/5] sched: add helpers for numa balancing Yafang Shao
2026-10-19 7:14 ` bot+bpf-ci
2026-10-19 6:41 ` [RFC PATCH v3 bpf-next 4/5] sched: add BPF-based per-cgroup NUMA balancing mode selection Yafang Shao
2026-10-19 6:58 ` sashiko-bot
2026-10-19 7:40 ` Yafang Shao
2026-10-19 7:24 ` bot+bpf-ci
2026-10-19 6:41 ` [RFC PATCH v3 bpf-next 5/5] selftests/bpf: add tests for the numab kfuncs Yafang Shao
2026-10-19 6:51 ` sashiko-bot
2026-10-19 6:55 ` Yafang Shao
2026-10-20 16:54 ` [RFC PATCH v3 bpf-next 0/5] BPF-based per-cgroup NUMA balancing mode selection Tejun Heo
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=cbf93381e02861620b012ace93c816f2c0822fea.camel@linux.intel.com \
--to=tim.c.chen@linux.intel.com \
--cc=akpm@linux-foundation.org \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=cgroups@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=david@kernel.org \
--cc=eddyz87@gmail.com \
--cc=gourry@gourry.net \
--cc=hannes@cmpxchg.org \
--cc=juri.lelli@redhat.com \
--cc=laoar.shao@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=lizhe.67@bytedance.com \
--cc=memxor@gmail.com \
--cc=mingo@redhat.com \
--cc=mkoutny@suse.com \
--cc=peterz@infradead.org \
--cc=roman.gushchin@linux.dev \
--cc=shakeel.butt@linux.dev \
--cc=stable@vger.kernel.org \
--cc=tj@kernel.org \
--cc=vincent.guittot@linaro.org \
--cc=yu.c.chen@intel.com \
--cc=zhao1.liu@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.