Re: [PATCH v3 18/26] sched/core: Annotate runqueues into meminspect

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] Calling virt_to_phys() on a per-CPU pointer yields an invalid physical address and causes kernel panics.
- [Medium] Registering runqueues per-CPU dynamically will exhaust the meminspect inspection table on systems with large core counts.
--

--- Patch [18]: [PATCH v3 18/26] sched/core: Annotate runqueues into meminspect ---
commit 63843371f43c4c6cde135f463d4c294cece8bc8f
Author: Eugen Hristev <ehristev@kernel.org>

sched/core: Annotate runqueues into meminspect

This commit annotates runqueues for the meminspect API by explicitly
registering them during sched_init() since they are per-cpu allocations.

> diff --git a/kernel/sched/core.c b/kernel/sched/core.c
> index 2e7cde033a319..1c2e80a54d2b6 100644
> --- a/kernel/sched/core.c
> +++ b/kernel/sched/core.c

[ ... ]

> @@ -9059,6 +9060,7 @@ void __init sched_init(void)
>  #endif
>  
>  		zalloc_cpumask_var_node(&rq->scratch_mask, GFP_KERNEL, cpu_to_node(i));
> +		meminspect_lock_register_va(rq, sizeof(*rq));

[Severity: High]
Does passing a per-CPU pointer to meminspect_lock_register_va() work correctly
here?

The meminspect_lock_register_va() macro expands to meminspect_register_id_va(),
which calls virt_to_phys() on the provided address. Since dynamically allocated
per-CPU memory resides in vmalloc space rather than the direct linear mapping,
won't calling virt_to_phys() on 'rq' yield an invalid physical address?

If CONFIG_DEBUG_VIRTUAL is enabled, this could trigger a VIRTUAL_BUG_ON() panic
during early boot, or otherwise lead to invalid physical memory mapping in the
meminspect table.

[Severity: Medium]
Will registering every possible CPU's runqueue exhaust the meminspect dynamic
IDs on large systems?

Because this registration sits inside the for_each_possible_cpu() loop, it
consumes a dynamic slot for every CPU. The meminspect table has a static array
limit (MEMINSPECT_ID_MAX, typically 201), with dynamic slots starting at
MEMINSPECT_ID_DYNAMIC (~33). This leaves around 168 available slots.

On machines with high core counts (e.g., 256 or 512 CPUs), this loop will
exhaust all available dynamic slots. Any subsequent kernel subsystems attempting
to register dynamic memory regions will then fail silently.

>  	}
>  
>  	set_load_weight(&init_task, false);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260708-meminspect-v3-v3-0-7aa5a0a74d5c@oss.qualcomm.com?part=18