From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from LO0P265CU003.outbound.protection.outlook.com (mail-uksouthazon11022101.outbound.protection.outlook.com [52.101.96.101]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 47C04383C6B for ; Sat, 8 Aug 2026 23:55:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.96.101 ARC-Seal:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786233338; cv=fail; b=VaqKPG85egGpgq4P5eJuCJxLjYZONIQL98eRZ4MogO8nK5cCsdzdXSG1BsQ5hri3Qtwzvys+RynDC9GlMnDdsxh6KsWwyXJnnllBM8Pn7Y4J7VsBVV4IoDYx9IDu3rlylwjhdRhanRRH9BdSzJ/wFdp7ifqJDpISMTHIBKHqD60= ARC-Message-Signature:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786233338; c=relaxed/simple; bh=Dajg1fb0VQIqNJLF0XeQoIG2qCnx/O2WyTKKwgoLlZE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: Content-Type:MIME-Version; b=pMjQ7BH3stZhoeVwBviQZxSHrUrO91FH8smZWrXvvr7ScFRwGsPttJzFbI1RkHcls+V58q4GNayuC61hQ6ZOutsFTxL23ZNlv//6W8cWnaxUGU+jzv2Gg66lyh//WEFtncTb6cAQa6r7mdZPXh/gcWPLDN15PH9bRZhYXGOSsk0= ARC-Authentication-Results:i=2; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=atomlin.com; spf=pass smtp.mailfrom=atomlin.com; arc=fail smtp.client-ip=52.101.96.101 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=atomlin.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=atomlin.com ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=rmqFjzo9DHVxGGq1tkMC5ZTf9VsnoPVGzWnSrfUM4lukZk9aBRm7xiDY6/sKp7SfFvkQC8Q2giqtE3LsE6pFiMxiyz5X8wqiycFtByfTYAv9gM4lYHt/G9bggcTPMsyNqt/13TTnMNX99IQjiS8BxFb9ewEKBhumxEYcxQkmTBWVB+MJY6tY9RQ5oUwh6HZ8dJLmtnJP88dIHt5GiyawGO0ba52CU0m+KYHB6ItLgyTlBh43duL0qOJSV0vzzKug4I4iHb53+yGJZxBLQf6D6mcJ+t6D95LlrwhbenOJjDxe8lxe91CCB9Pm4CYl0ngEHtHIe5YwdVl1NBOO83Ojeg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:MIME-Version; bh=BkYfCHGgmVGpIMlFVN3P7y0eWfzERl5SXFz5j958PSQ=; b=mMDmw1u7dN3tspwXND2G14JSrkHPXZ0uPECLYkbqk8oKZCHcGQ9AnG0NX41mB7YgS+m4uvWY9GXYpk8lDWOv00QYtytS7XwLP4BgYNE5sO77vaFaYMUYrdMBijsj76smAfBbHZwzg7/AGZJaxhgd6Q4QPY160tPZCf2whZoNj793EZvmmAxTPmKV/RimhEWhvSDvCv9OsQPujaKjyGpR5mSmzeAJO4guP9X12/EPPWX4vPkW++NSks3DqaxjAV0Ts82naHF8UE3ugSitteRsaghzgFL0unOlqkgYyiFRBroMm9MFn0dnfQg2PdFGR0m0T5yEu1gn3oJ2qzSJ5sOGmg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=atomlin.com; dmarc=pass action=none header.from=atomlin.com; dkim=pass header.d=atomlin.com; arc=none Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=atomlin.com; Received: from CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:183::5) by CW1P123MB8837.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:274::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.292.25; Sat, 8 Aug 2026 23:55:34 +0000 Received: from CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM ([fe80::cec4:77ab:262e:d230]) by CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM ([fe80::cec4:77ab:262e:d230%4]) with mapi id 15.21.0292.024; Sat, 8 Aug 2026 23:55:34 +0000 From: Aaron Tomlin To: mingo@redhat.com, peterz@infradead.org, juri.lelli@redhat.com, vincent.guittot@linaro.org Cc: dietmar.eggemann@arm.com, rostedt@goodmis.org, bsegall@google.com, mgorman@suse.de, vschneid@redhat.com, kprateek.nayak@amd.com, zhanxusheng1024@gmail.com, neelx@suse.com, chjohnst@mail.com, mproche@mail.com, sean@ashe.io, steve@abita.co, linux-kernel@vger.kernel.org Subject: [PATCH v3 2/4] sched/debug: Protect lockless rq->rd access in print_dl_rq() Date: Sat, 8 Aug 2026 19:55:20 -0400 Message-ID: <20260808235522.380038-3-atomlin@atomlin.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260808235522.380038-1-atomlin@atomlin.com> References: <20260808235522.380038-1-atomlin@atomlin.com> Content-Transfer-Encoding: 8bit Content-Type: text/plain X-ClientProxiedBy: BN9PR03CA0544.namprd03.prod.outlook.com (2603:10b6:408:138::9) To CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:183::5) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CWLP123MB6607:EE_|CW1P123MB8837:EE_ X-MS-Office365-Filtering-Correlation-Id: 73330726-48dc-4abb-5a86-08def5a88975 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|7416014|1800799024|366016|23010399003|6133799003|10067099003|56012099006|22082099003|18002099003; X-Microsoft-Antispam-Message-Info: i8Q7P4UJLE0C4vNif6iclLZjKfWj9hQ/tJ98Ef13p1pwhzErw/YC1zVXa+VxlP7Ed/VsWM0d/E6GONaoSuNrB0T0JWyXbEaKeH2UMsOnF/RFmEwuWd+4pBkjSOvFyyLx+hLunycF1DV1DU09AkpntKHGmQEcxswiwRRxoYHlFbWx7uqL/JyQj7Jl3aIyOi2rtuzGxhFEqCgPq03dj/q6oybyb8JBC4NjkkZ+pBmjFclB5YBLh7/9AsnHeBKBMd7Uk5cFqzcteV8pt+ascNiXf3MyoCLv/ddVSj2iXVt7O2aVgm6V2nla0MRhQFvjX8wb7BSE3Uste0unlJEyDj93y49u1z9Uf3q4lnJAk4Mv24UPc+dge5k75GKBVTBmj/hodBhaL+Hb4bolLC6Z80CqGQoQc4xN2U131aJ42Ywxz392OlLEUuH/V//sBGm1onjXz9G54vXLCOxGGRUBcyVGx1VyVWG1EkCoPX/Wyb7KD2MRfJFg97kgQmQcpBZ37SmX8aULBh75ojLKj4yaz2KwJZEN2eEwiSn7O/Ezasi+Y7OUDWZaickO0pY30oUX40wdGgfxI15xlHgJHXwStgs15QlVt6Gkul5AVZtkZehetFMKDDmkiZB3ZLQKUv/Hpvj/vaS0xO+hnrau4jt9hbOCmHkgUfGF0LliXtsIIwB6olo= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(376014)(7416014)(1800799024)(366016)(23010399003)(6133799003)(10067099003)(56012099006)(22082099003)(18002099003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?2tyTxAVxMaDNZ02/w4fsEQFCwGVIOYx6c+Kx23BAes9O8m4yp/G8RJqyKJfC?= =?us-ascii?Q?rDCp685rNnUsd70Kc8FUYcnnjGtXdLxgk4EgpvNQoNP6G6tvPRUu7TDRoK8M?= =?us-ascii?Q?ebgKkDlK+g/BrQHeLA1XFXnoIzSFI4SAHPWg/VV4CrWz2Xp6GazoXK9Ojc0I?= =?us-ascii?Q?M8utejuIBaWxkZYhD4fjPlU5SyiH2v49Dl58cZidfkGzzNeDJsA+OsURG9Lc?= =?us-ascii?Q?ioY0HrLYkRxQpJ4+jd0a8uvY2JQm6qRaS5GVJI6fSZ6H9ElCsEKSl1YhbIBf?= =?us-ascii?Q?alASzeQfezmaECO4+Pui1R+nxfiaRhFlisGqBr2LlGCoBfjOHL3KhC1KuP2M?= =?us-ascii?Q?ghv7KDGFTMAlY2CBAM+qXlUI6iLfInau/Y7nPfCKcKHJSXQ2Isw9rzENjEXI?= =?us-ascii?Q?5yWPNM7pS4Zt4qRN1CDW+F8YoVFQwmvnxelKXUsxWr8b/RPuBK3Anehcf/uj?= =?us-ascii?Q?rVgmcfFgqpdlXpMWmYEepqswoeyam8zjUUgW12t1pcfefcLQ34hMy2VmBlYt?= =?us-ascii?Q?SXAJpSzFDecwSRQm9tVFRdqWj6aivOsEMX7oL1b+IwsDj9JCLz8WjBHY0nnZ?= =?us-ascii?Q?EFirfMcbkA/nVTH9koWp2/pMvfmiT7v8ltF6Sw/kelrciUGz/xW6HR/Q/7Z5?= =?us-ascii?Q?VD6aejUh12t5fkC0sW+xUnNoljHdYM1uOMUx201Qzit97PDKwBnY2syoW43d?= =?us-ascii?Q?koaAvuvp5r7XF0crAS5Hyfo+ClbnkvFQHDgOGiMkY2tQ23UlMS+FJHR3+oPl?= =?us-ascii?Q?y54CeqcDY8NESglLD7UJ9b5PzbjpoTsIqgEcEOV/ubZZk1uhjqESzOzartzK?= =?us-ascii?Q?f+By/0FpN2LSI0a/2fwmB/fYVtrXaFPdIZdd+myNM7cVmAqy5oDIatjbiw4k?= =?us-ascii?Q?xv7DgL4qwjXQC+I4ojq1rabVMFMDsYLe2aJCBBnW2h0cLnVoIlNCdr/pbHT+?= =?us-ascii?Q?y0lqg/SEFtDAYRz4sABlBZ+ku2OSfsbXRHSiBun1v7cUOI/DCSI7Ww0/cgHi?= =?us-ascii?Q?sViFg1TthksPN/xLePA+FC4PSQqO9EU+dBxc7qeWlTlKZB9D7H1anJdqllsG?= =?us-ascii?Q?gbC2mtxSa9zgMFzMr4qrxA0ta3dAlMt3vS4Jr7L2EvVzlLo+yWymg74QkSh/?= =?us-ascii?Q?yj1CJGJUtZzhFFiWSW2Kv6JMfZvpZyl38cPnUwHNB2RpXkeZ6FPxQLapAJ4B?= =?us-ascii?Q?jSpecuyFFdKc1X5vs3A2VNqVCDAzj1YIPs1mcMmQspuqLUaVUJuaT+EXOin/?= =?us-ascii?Q?MwaV5XdkoDGVrGAr9iuc5VBPKfoYjULFcd9ofUoEysFdhcFXb6351yAbQjxH?= =?us-ascii?Q?XL8rLnp/3YwN+ZWbC4yZF31kzsrqsBW8fatOfK1zB78QImOzwv/pMNSrqOlo?= =?us-ascii?Q?PCG6AfOuDFQuI5Fr/dhxEJdcsBe6stmjxR02ILQQ5x/TEA7BNBepUi+1TPXZ?= =?us-ascii?Q?xsK5n3rXdM/Ne47UZO/R4vSloj0jkr/5i4zq/hnB2kKG/sAbCj9ZP6aEccex?= =?us-ascii?Q?1QKv49JfTkuYTofFRyn8k0Rk6NxTDCPmARwxw14SRfxqudy4lNFAyPjlEM1f?= =?us-ascii?Q?CMEnJEktMAUxGpDjWHryfVs+OJGb4XAZvDxXdsotSYOdKH3i3MoCpU20UZAC?= =?us-ascii?Q?EhHsX7oxLcUveCeCf74q/K6bGEu8MZK+L+3CLKJp+XV9dCtGygdqisXeLhlV?= =?us-ascii?Q?guA5grgOOiaza0j3F8ITYEK/Mau1LtOtG7mua2QC7puICyvIDxkPEyXFQm4G?= =?us-ascii?Q?63CNOl09Ow=3D=3D?= X-OriginatorOrg: atomlin.com X-MS-Exchange-CrossTenant-Network-Message-Id: 73330726-48dc-4abb-5a86-08def5a88975 X-MS-Exchange-CrossTenant-AuthSource: CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 08 Aug 2026 23:55:34.3846 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: e6a32402-7d7b-4830-9a2b-76945bbbcb57 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: kIzecSi+A9jCqT7hvLJJ0M+ZGf+skfwrgC5ZyQmV3oMYB5ko8JpkbmtGwN06Fw6Th6le19yuS3BfdnvX8LKZEA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: CW1P123MB8837 In print_dl_rq(), cpu_rq(cpu)->rd is dereferenced locklessly to display deadline bandwidth statistics. During CPU hot-unplug or cgroup cpuset repartitioning events, partition_sched_domains() calls cpu_attach_domain(), which executes rq_attach_root() to detach the CPU from its root_domain. When the reference count of the detached root_domain drops to zero, rq_attach_root() calls call_rcu(&old_rd->rcu, free_rootdomain) to schedule memory teardown after an RCU grace period. Because print_dl_rq() does not hold an RCU read lock while dereferencing cpu_rq(cpu)->rd, an RCU grace period can elapse concurrently while debugfs is reading the file. This allows free_rootdomain() to execute kfree(old_rd), introducing a use-after-free race condition when print_dl_rq() reads dl_bw->bw. Fix this by fetching rq->rd using READ_ONCE() inside an RCU read-side critical section. Holding the RCU read lock guarantees that the struct root_domain memory remains valid while being accessed. Fixes: 02968ccf7b80 ("sched: add /proc/sched_debug file") Reported-by: sashiko-bot Signed-off-by: Aaron Tomlin --- kernel/sched/debug.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c index 78fc02d71710..e9d40a660346 100644 --- a/kernel/sched/debug.c +++ b/kernel/sched/debug.c @@ -1081,6 +1081,7 @@ void print_rt_rq(struct seq_file *m, int cpu, struct rt_rq *rt_rq) void print_dl_rq(struct seq_file *m, int cpu, struct dl_rq *dl_rq) { struct dl_bw *dl_bw; + struct root_domain *rd; SEQ_printf(m, "\n"); SEQ_printf(m, "dl_rq[%d]:\n", cpu); @@ -1089,9 +1090,14 @@ void print_dl_rq(struct seq_file *m, int cpu, struct dl_rq *dl_rq) SEQ_printf(m, " .%-30s: %lu\n", #x, (unsigned long)(dl_rq->x)) PU(dl_nr_running); - dl_bw = &cpu_rq(cpu)->rd->dl_bw; - SEQ_printf(m, " .%-30s: %lld\n", "dl_bw->bw", dl_bw->bw); - SEQ_printf(m, " .%-30s: %lld\n", "dl_bw->total_bw", dl_bw->total_bw); + rcu_read_lock(); + rd = READ_ONCE(cpu_rq(cpu)->rd); + if (rd) { + dl_bw = &rd->dl_bw; + SEQ_printf(m, " .%-30s: %lld\n", "dl_bw->bw", dl_bw->bw); + SEQ_printf(m, " .%-30s: %lld\n", "dl_bw->total_bw", dl_bw->total_bw); + } + rcu_read_unlock(); #undef PU } -- 2.55.0