[PATCH] sched_ext: Gate cid kfuncs behind the SCX struct_ops check

[PATCH] sched_ext: Gate cid kfuncs behind the SCX struct_ops check

[Qiurong Fang]

From: fangqiurong <fangqiurong@kylinos.cn>

scx_bpf_cid_to_cpu(), scx_bpf_cpu_to_cid() and scx_bpf_cid_topo() live in
the scx_kfunc_ids_cid set, but scx_kfunc_context_filter() doesn't check
that set. The filter's first test treats any kfunc outside its known sets
as non-SCX and allows it, so these three kfuncs can be called from any
struct_ops program - e.g. a TCP congestion control program.

Add scx_kfunc_ids_cid to the filter's known sets, matching how in_any and
in_idle are handled.

Fixes: e9b55af47edf ("sched_ext: Add topological CPU IDs (cids)")
Assisted-by: Z.ai:glm-5.2
Signed-off-by: fangqiurong <fangqiurong@kylinos.cn>
---
 kernel/sched/ext/cid.h | 1 +
 kernel/sched/ext/ext.c | 9 +++++----
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/kernel/sched/ext/cid.h b/kernel/sched/ext/cid.h
index 1f74d1f331f5..2fe2311a0f99 100644
--- a/kernel/sched/ext/cid.h
+++ b/kernel/sched/ext/cid.h
@@ -67,6 +67,7 @@ extern s32 __rcu *scx_shard_node;
 extern struct scx_cid_shard __rcu *scx_cid_shard_ranges;
 extern struct scx_cid_topo __rcu *scx_cid_topo;
 extern struct btf_id_set8 scx_kfunc_ids_init_cids;
+extern struct btf_id_set8 scx_kfunc_ids_cid;
 
 void scx_cmask_clear(struct scx_cmask *m);
 void scx_cmask_fill(struct scx_cmask *m);
diff --git a/kernel/sched/ext/ext.c b/kernel/sched/ext/ext.c
index f9631e66a9fc..317eb0110c64 100644
--- a/kernel/sched/ext/ext.c
+++ b/kernel/sched/ext/ext.c
@@ -10762,19 +10762,20 @@ int scx_kfunc_context_filter(const struct bpf_prog *prog, u32 kfunc_id)
 	bool in_idle = btf_id_set8_contains(&scx_kfunc_ids_idle, kfunc_id);
 	bool in_any = btf_id_set8_contains(&scx_kfunc_ids_any, kfunc_id);
 	bool in_cpu_only = btf_id_set8_contains(&scx_kfunc_ids_cpu_only, kfunc_id);
+	bool in_cid = btf_id_set8_contains(&scx_kfunc_ids_cid, kfunc_id);
 	u32 moff, flags;
 
 	/* Not an SCX kfunc - allow. */
 	if (!(in_unlocked || in_init_cids || in_select_cpu || in_enqueue || in_dispatch ||
-	      in_cpu_release || in_idle || in_any))
+	      in_cpu_release || in_idle || in_any || in_cid))
 		return 0;
 
 	/* SYSCALL progs (e.g. BPF test_run()) may call unlocked and select_cpu kfuncs. */
 	if (prog->type == BPF_PROG_TYPE_SYSCALL)
-		return (in_unlocked || in_select_cpu || in_idle || in_any) ? 0 : -EACCES;
+		return (in_unlocked || in_select_cpu || in_idle || in_any || in_cid) ? 0 : -EACCES;
 
 	if (prog->type != BPF_PROG_TYPE_STRUCT_OPS)
-		return (in_any || in_idle) ? 0 : -EACCES;
+		return (in_any || in_idle || in_cid) ? 0 : -EACCES;
 
 	/*
 	 * add_subprog_and_kfunc() collects all kfunc calls, including dead code
@@ -10809,7 +10810,7 @@ int scx_kfunc_context_filter(const struct bpf_prog *prog, u32 kfunc_id)
 		return -EACCES;
 
 	/* SCX struct_ops: check the per-op allow list. */
-	if (in_any || in_idle)
+	if (in_any || in_idle || in_cid)
 		return 0;
 
 	moff = prog->aux->attach_st_ops_member_off;
-- 
2.43.0

Re: [PATCH] sched_ext: Gate cid kfuncs behind the SCX struct_ops check

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing negative bounds checks in memory cgroup kfuncs (`bpf_mem_cgroup_memory_events` and `bpf_mem_cgroup_vm_events`) allow out-of-bounds array access.
--

--- Patch [1]: [PATCH] sched_ext: Gate cid kfuncs behind the SCX struct_ops check ---
commit 44e99221673a68d8565292bb70385d8d0629f96c
Author: fangqiurong <fangqiurong@kylinos.cn>
sched_ext: Gate cid kfuncs behind the SCX struct_ops check

This commit updates scx_kfunc_context_filter() to recognize scx_kfunc_ids_cid.
It ensures that cid kfuncs are properly restricted and cannot be called from
arbitrary struct_ops programs.

[ ... ]

While reviewing this, I noticed a pre-existing issue in the BPF memory
cgroup kfuncs.

In mm/bpf_memcontrol.c:

> __bpf_kfunc unsigned long bpf_mem_cgroup_memory_events(struct mem_cgroup *memcg,
> 						       enum memcg_memory_event event)
> {
> 	if (unlikely(event >= MEMCG_NR_MEMORY_EVENTS))
> 		return (unsigned long)-1;
> 
> 	return atomic_long_read(&memcg->memory_events[event]);
> }

[Severity: High]
This is a pre-existing issue, but can a negative enum value bypass this bounds
check?

If a BPF program passes a negative integer for the event argument, the BPF
verifier does not enforce enum ranges, allowing the negative value to reach
the kfunc.

Because the check event >= MEMCG_NR_MEMORY_EVENTS performs a signed comparison,
would it evaluate to false for negative values and lead to an out-of-bounds
read of memcg->memory_events[event]?

In mm/memcontrol.c:

> bool memcg_vm_event_item_valid(enum vm_event_item idx)
> {
> 	if (idx >= NR_VM_EVENT_ITEMS)
> 		return false;
> 
> 	return !BAD_STAT_IDX(memcg_events_index(idx));
> }

And in mm/bpf_memcontrol.c:

> __bpf_kfunc unsigned long bpf_mem_cgroup_vm_events(struct mem_cgroup *memcg,
> 						   enum vm_event_item event)
> {
> 	if (unlikely(!memcg_vm_event_item_valid(event)))
> 		return (unsigned long)-1;
> 
> 	return memcg_events(memcg, event);
> }

[Severity: High]
This isn't a bug introduced by this patch, but does memcg_vm_event_item_valid()
also miss negative enum values?

Since the bounds check uses a signed comparison, a negative idx evaluates to
false for idx >= NR_VM_EVENT_ITEMS.

When bpf_mem_cgroup_vm_events() passes an unfiltered enum to this helper, could
this result in an out-of-bounds read in memcg_events_index(idx) or
memcg_events()?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260812061116.2691443-1-fangqiurong@kylinos.cn?part=1

Re: [PATCH] sched_ext: Gate cid kfuncs behind the SCX struct_ops check

[Tejun Heo]

Hello,

On Wed, Aug 12, 2026 at 02:11:16PM +0800, Qiurong Fang wrote:
> scx_bpf_cid_to_cpu(), scx_bpf_cpu_to_cid() and scx_bpf_cid_topo() live in
> the scx_kfunc_ids_cid set, but scx_kfunc_context_filter() doesn't check
> that set. The filter's first test treats any kfunc outside its known sets
> as non-SCX and allows it, so these three kfuncs can be called from any
> struct_ops program - e.g. a TCP congestion control program.

Applied to sched_ext/for-7.3.

Thanks.

--
tejun