From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from LO0P265CU003.outbound.protection.outlook.com (mail-uksouthazon11022101.outbound.protection.outlook.com [52.101.96.101]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9A7ED313E00 for ; Sat, 8 Aug 2026 23:55:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.96.101 ARC-Seal:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786233337; cv=fail; b=Xi7DbB2Y2xT6qRfVazUbdAPESiWJBedCUf8L+hdEMx434kyU4N33felKTwvbHLgCOwB/NC0+nl3z6/5ejSHQBCvdKjSDYSZ7yVx89ZsE+7/XkmydT/9Aund47KEainljbm5X5RYDIhrtzT3jnnilc3850A8ACC5YoWWHZkweqn8= ARC-Message-Signature:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786233337; c=relaxed/simple; bh=swRETAEQgjYgJ9Urc76zGstOBNMYKUlREmrTAuNyt08=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: Content-Type:MIME-Version; b=Paxk/zTbOSf7oqziM7lXKJfLVBofNvOt+Jwg51NSpe6QB/IkHqxWwMCzIJMcnAQ513L0NUq2ZLBIIGjqumL3jRn4r+c6iJ9axnEfNxFOqRXp7cVDyEvLHAiLcPOPc70JMl2wT1j7vIh+34+ZY5qLXyGeA8GH2pqf37y8PsEF+rE= ARC-Authentication-Results:i=2; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=atomlin.com; spf=pass smtp.mailfrom=atomlin.com; arc=fail smtp.client-ip=52.101.96.101 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=atomlin.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=atomlin.com ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=fnEhlt+/X14EILcHQpe0OKacTyRk47nnwofBgOUVPDv/jGrjAU207qaMi4xNPZJcz1qUwADh3UoL0fBQrJHbRcAAt5Fi79O763KvUvAfunDYzsQRDFuS/Pe4L/lbtj3AnVCR/alN1E4y8YmpKpFmIbVez6PCfk5xjAr+/NoWjzTgvEMbzqzdVuYnnLDNphds44nlwh+QJS+So7SZG6tzOPWe6YElce4JtIwtzzOPepqIyk1KSfa45XNKBFgxZwv+ujNmboURHzy/qBRY6G0xmB5EwTlBGMdcH+vuLdpBixNpd0wYvBgecW0Ak+p89nG4xam28TIsu4psNeNfMv9SvQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:MIME-Version; bh=T3QgEa3Uk2wDagWPWsvzm8l26iiroGN5CKe5EQPwnrg=; b=PfLuX+jt8onqril0Ako0YSO2/ysyX6HCkvxToakWTTJxXyEZWVwqSIdSAKTf8hONOgUs5aUMkhBmkzaR/jlaAB7GnnXBV0j56rsWnNCsLCeJJZoIWUj/18na7ybRWoNrH84leiwDqVlYticjOQevIAm/2u6pZOO8ORHA2c3rLUMMqciIeOdcgoDTWHXuUlWa6s7t+IdU4jj9uMX2nLnHHdjz1zbhycYuC9HIULbwTOZEaG9aFE/phizWDegPsFcdghOyavq44dl/W9vfqUrineHgH9d1KfYxP/WlhXhj6wkHVn2KauQMsR5vVqsUiG1ckGlPIPEvmLJJIzhYfx8nKg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=atomlin.com; dmarc=pass action=none header.from=atomlin.com; dkim=pass header.d=atomlin.com; arc=none Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=atomlin.com; Received: from CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:183::5) by CW1P123MB8837.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:274::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.292.25; Sat, 8 Aug 2026 23:55:30 +0000 Received: from CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM ([fe80::cec4:77ab:262e:d230]) by CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM ([fe80::cec4:77ab:262e:d230%4]) with mapi id 15.21.0292.024; Sat, 8 Aug 2026 23:55:30 +0000 From: Aaron Tomlin To: mingo@redhat.com, peterz@infradead.org, juri.lelli@redhat.com, vincent.guittot@linaro.org Cc: dietmar.eggemann@arm.com, rostedt@goodmis.org, bsegall@google.com, mgorman@suse.de, vschneid@redhat.com, kprateek.nayak@amd.com, zhanxusheng1024@gmail.com, neelx@suse.com, chjohnst@mail.com, mproche@mail.com, sean@ashe.io, steve@abita.co, linux-kernel@vger.kernel.org Subject: [PATCH v3 1/4] sched/debug: Protect lockless rq->curr access in print_cpu() Date: Sat, 8 Aug 2026 19:55:19 -0400 Message-ID: <20260808235522.380038-2-atomlin@atomlin.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260808235522.380038-1-atomlin@atomlin.com> References: <20260808235522.380038-1-atomlin@atomlin.com> Content-Transfer-Encoding: 8bit Content-Type: text/plain X-ClientProxiedBy: BN9P220CA0020.NAMP220.PROD.OUTLOOK.COM (2603:10b6:408:13e::25) To CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:183::5) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CWLP123MB6607:EE_|CW1P123MB8837:EE_ X-MS-Office365-Filtering-Correlation-Id: c40fa6d0-e8ca-4a90-7c29-08def5a88722 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|7416014|1800799024|366016|23010399003|10067099003|56012099006|22082099003|18002099003; X-Microsoft-Antispam-Message-Info: HIr38X7mfrlO2ub4JmWcZg6ydkg96/CwkEzTT4zFj4MyHg/+0+enrdkGE2y+x0jT4VjINFP9ZrPhD9DZuOX6XUpvNcPznmGFaIssHMNxjCa8MIKYfzmKVPLYX64NjPB9b1VTHfA4S6ZRTkAQXKQ+64zWq8sXCBkO+nnnPQo3sDYX5R60dpRcOPXRALGSFbqkTaLyZNPlOM4+/9HVP1vPGWatcAhKOjhR84UZYndcH+9WzEoabKAbOgMepBKpIs7OHfydwNXLBP4cxDx7eabTkgNULXge/Pn9XzKGpFsckKQMZT11+c0MRWQVc2IhUbRvd023T/C5DaD5Aeg1n25mrif+5BghPZ2sPkDkrhZBtIeTtj5mQSc80BSMYJRcIZR5NE0FNFfVe7XgStRXcRv+EQmIB8Wf1gJiejSqMG0BecFJLtYnTcV8DExBLQsxbLE03wyZrx5ekLZK16YMLpIVaK1tcYex5optlhAr0vOU0Az+QST6XeDs5t468GMy4C8Xg1cuZCJOR0CtDkvi8kVFMxCAYnrHq3e6bvD5GA7rU/aPFagN6FjJ0XO7DvVOMfkaezASGqd+ojaEs21ZjrPYuReE1ul4HN42HnLOjCqziAO9CbSyniBk9oNesSbjBblOsWom1UFBirs76xrMi1yPzdvefaWIrucuvGWHJ4clz1w= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(376014)(7416014)(1800799024)(366016)(23010399003)(10067099003)(56012099006)(22082099003)(18002099003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?QrkqCwkEmETtATYq0UegKx9q47tvHtDkuVX5E51gwPtWOVQVigcusOpmu3ak?= =?us-ascii?Q?N2vxvrsepqHuYM1/rmFzyrqk6/tssJF41C1SeTmO9q+WDWRoE8jWhgnZULDE?= =?us-ascii?Q?so6Ow6sM1Wq0J239zEXLlkT9PM3wKepdfLEFAhfsW+cSVnlTkmDkUeZPe6OC?= =?us-ascii?Q?OfdjAq9pcjiW65FG9BR/I31zoaYubVQRJvES1UiwNeUinU/3aO50nwIhtZyt?= =?us-ascii?Q?PaaRfblbNoJ1KnvrDieXpMb1kFYHhXaUDVjih9bJ53OF6PZjdu2wg/Sbn/Z2?= =?us-ascii?Q?8ZiTh/cUWOIo/Hz4IHiujKOOFSVrY1OBc7+0hDoaskniGdkyK1N3SdlCQ/3L?= =?us-ascii?Q?XVWthg1wifqOc1mZLey/gq38utXS+SNxyFIdfO0RBwQdYWG/i7cTgPlAT06I?= =?us-ascii?Q?F9apeVvrrKz8VVFf2C3IiPasBtb4K5KA8KyHPnpB1/MddmFAOhaBaRjjj5/R?= =?us-ascii?Q?GPsaScmMndwG8KAl5lbHqUlKZN8aFuhbZfsSWkdEmautZV0AppMij9qXVBnT?= =?us-ascii?Q?oNrmrRHzL8cdDN7zAZCygIDr7hqxnQajutyrUxNgrU+Es83grKCBeb/cfdVt?= =?us-ascii?Q?i0q2KY4CT6NW+GyN4neNgCsa7X89bWwgCDyTP3fv4VQND3bRk2P65xy2ScpU?= =?us-ascii?Q?0dGVxrC6E/R2iXeNsWsXZ1JDXZ+NM6YoyoS0n8hy9lV671pIPj5vOdsy2O4g?= =?us-ascii?Q?szC8me5/fEZl4fLsyCikmxMUl9k72yYK9BxkVic/CChPrXTrzMWHsG4X4v2c?= =?us-ascii?Q?TDQBUuKAQbKw+3nybqEaWKpn/WtVwmdIC5K3bmAuMv9yfXmhYZaqdUNJzrJ0?= =?us-ascii?Q?KBF29yGvFzs+0vcINOFc+ME4H48meYhZr3Z8+Pq5O2F0WPwtUw9f0dtJmUnt?= =?us-ascii?Q?RYgDHFrYNp0kCBxsx4767zpACmzyG2chTZD3yJ7r4NnHl6j5/RxRqQnoLjSg?= =?us-ascii?Q?sQYJV6r8TYhsfbVIVVtM+IO51I8d/gKB9sCIj7nltLm5Nj5/rPZkdf5ImLel?= =?us-ascii?Q?9/CcNeTXJAo5aULijJN5cjxSeJulWV3xNYwVN19vY5/80vniyq430rwgkePm?= =?us-ascii?Q?n40kcc+m1zjo7bcGvXTKVq28aa/EXVVd3s5014CZOXyZXsvgF27odhnLzZPx?= =?us-ascii?Q?usqJsEpyj57A58YWfOzWMsBFcKsMlrS2DR2yYcVYy4ByrCJQRGIvGQdJZ5AN?= =?us-ascii?Q?SRKyY71zQAm7qge9kz3uHmr3CSFuSOq8Oexu5FglVXSuQf5zC9QKYyqU8xF3?= =?us-ascii?Q?auMUINAFiqriRj36Pn4TaSK9WboRr3DJ7fQYdSkNo5equcgkwQpqQOLLPFGh?= =?us-ascii?Q?7GeWQEHije/WwBFC0Al+PRNLoQXHEFOaFdABPx2tnJQe+Tt/dO3SCd5bbpXv?= =?us-ascii?Q?Qf0+edzNnJQmUvfMVvur2+e9qRPwzRZx/eXyzfiMAeGKQ2PBW7vcg/9BHAdY?= =?us-ascii?Q?MU6pFLfzt5SUPNz4fNGY6Kn1EKmCdGp7iaAduGcdlVo973GT99fl25I2eMM6?= =?us-ascii?Q?ucCTIzYfmuUF+j6R11vYt+LGuIetY3pu34Ps6mTz4gU55KTQySIzqmjnrC3k?= =?us-ascii?Q?l5hj2rlaskZdB7O6ZoaLyPlynylaO2HYAy+gUgqOyyXOe0j9yzD0Az/tWx+t?= =?us-ascii?Q?iRUulK3LzTYRu46cafTbYX6f9dthRgiOh41aARhWqdIp0ldQTxrcZMajf2S9?= =?us-ascii?Q?2vMJMms17+aYHNpglLEzvC5aKZAMMwz2XchVDN1+4n/RcMXySdWB2VEc0auk?= =?us-ascii?Q?xszM9O6nvg=3D=3D?= X-OriginatorOrg: atomlin.com X-MS-Exchange-CrossTenant-Network-Message-Id: c40fa6d0-e8ca-4a90-7c29-08def5a88722 X-MS-Exchange-CrossTenant-AuthSource: CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 08 Aug 2026 23:55:30.4669 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: e6a32402-7d7b-4830-9a2b-76945bbbcb57 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: CpL0dHUoaW8bZcPQdPDSHJJfnixunaZMjAUeJyQmQXS5F7YgtGch9WHxPak1Nkm11Fwc2T4Z3+ZAnH4hZXBu0w== X-MS-Exchange-Transport-CrossTenantHeadersStamped: CW1P123MB8837 In print_cpu(), rq->curr is dereferenced locklessly to print the current task's PID via task_pid_nr(rq->curr). While accessing /sys/kernel/debug/sched/debug is inherently best-effort only; rq->curr is indeed expected to change dynamically while print_cpu() is executing. However, if the task currently running on the CPU exits concurrently and its reference count drops to zero, put_task_struct() calls call_rcu() to schedule __put_task_struct_rcu_cb(). Because print_cpu() does not hold the RCU read lock while dereferencing rq->curr, an RCU grace period can complete concurrently and free the task structure via free_task(), creating a potential use-after-free race condition. Resolve this by reading rq->curr using READ_ONCE() inside an RCU read-side critical section. Holding the RCU read lock delays the invocation of __put_task_struct_rcu_cb() until after rcu_read_unlock(), ensuring that the struct task_struct memory remains valid while being accessed. Fixes: 02968ccf7b80 ("sched: add /proc/sched_debug file") Reported-by: sashiko-bot Signed-off-by: Aaron Tomlin --- kernel/sched/debug.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c index 40584b27ea0c..78fc02d71710 100644 --- a/kernel/sched/debug.c +++ b/kernel/sched/debug.c @@ -1126,7 +1126,10 @@ do { \ P(nr_switches); P(nr_uninterruptible); PN(next_balance); - SEQ_printf(m, " .%-30s: %ld\n", "curr->pid", (long)(task_pid_nr(rq->curr))); + rcu_read_lock(); + SEQ_printf(m, " .%-30s: %ld\n", "curr->pid", + (long)(task_pid_nr(READ_ONCE(rq->curr)))); + rcu_read_unlock(); PN(clock); PN(clock_task); #undef P -- 2.55.0