From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from LO2P265CU024.outbound.protection.outlook.com (mail-uksouthazon11021120.outbound.protection.outlook.com [52.101.95.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D44C5320A34 for ; Mon, 10 Aug 2026 01:58:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.95.120 ARC-Seal:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786327105; cv=fail; b=VdqyKk+mV8jzMsI9dUTR7SVh2DZtALxo7CU5S6OYfCVS4kRTwPEOd1PJh3ZO62rUIcWUNu2KGhDlXNkis6xbDBsUi9uWODeIMn+ooBBwNk3n+hxEcUtzOVyFljR42S04ta5HQXMcaD7qR+ZgeLtHlIw+8H0tXg8po+krfI2MY8E= ARC-Message-Signature:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786327105; c=relaxed/simple; bh=FLzlyDmzrpf2HY0bUzV4rsn7JXKQrFQtkTp00LluAc4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: Content-Type:MIME-Version; b=suZlFw8fAsVGpa5aBSiKcc0i800oUD6a5POQIA1PaBakuNNAeoWdD/Zr8jdK2Kt65zR7+03hxiIZf7jnLToGPgoqbh4RU3RsJFGH8fPKxTI1aGfmySU78Bk6q+RTHIEwIcFIUJdFasVMFq5f12MNzbHHRsiqm+x8c7QNWOv2Sik= ARC-Authentication-Results:i=2; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=atomlin.com; spf=pass smtp.mailfrom=atomlin.com; arc=fail smtp.client-ip=52.101.95.120 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=atomlin.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=atomlin.com ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=M7BpJtjO8ysIJniHgKYNOs/L4nBXnzwulpUmhJcxZmszTLg1UfxrBhHcBZV7jU7wm1WEJF6j9uj1dX9sbzEvMYxfu55t6dUz0xi1f8WFq9TODSzMJU+qkMR20PtLKMt4OBvXCUBAnUP2dbx9KJk6bWDzlahKPIcxprdOfBBWoGrdPj+2Zut+bJWaXlz+LEeEB7GBARkw9VMZDNiq+xuB1Njo15KNqTh3lMOUN43pIFkYwORIsjXL8h6k88tmgm2Pbq3AwpMntocWbzXwfY1rCLduFhiXALCp4suZ6+0311yEpoJXE4cGIAzSJCjOTXNvFpvO3+yo+cJ/KnQWaPcqgA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:MIME-Version; bh=yMYERihgj0Uxz11lVan7IzmiYEirB2gLQQc/6OosY/s=; b=avTLxoY8kBFGLJOQN3RuW9tqtAPDUv0hdpXb407mfNz/lwBDRDlUY/2msuuOWVpdaQkjZiVmHiBZIEhzB+cmG5Oia2dcecJLauIb9F742DvicD4qsCuF85EZer66Mu7dvkFTyDoQ2MVF1zzrCii7BbndZ7KQW8ych/XKVFgdjV1j6JfMpu038uLW7F8RznbUa3FxICUSaJLZ2OQ42PQKSZ1bzVSgxfPXxS37DwWXObUpACqJvw1O1jFbofZbXekj48eRM3tx2wm1v37mmcFsGAIGHsuczqONYI8wzCH3KS3Jwh2i9Vv6SyISgr/XrNbLZaW4n3vI8TFYkG889vC7ug== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=atomlin.com; dmarc=pass action=none header.from=atomlin.com; dkim=pass header.d=atomlin.com; arc=none Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=atomlin.com; Received: from CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:183::5) by CWLP123MB3891.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:a2::6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.292.25; Mon, 10 Aug 2026 01:58:21 +0000 Received: from CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM ([fe80::cec4:77ab:262e:d230]) by CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM ([fe80::cec4:77ab:262e:d230%4]) with mapi id 15.21.0292.024; Mon, 10 Aug 2026 01:58:21 +0000 From: Aaron Tomlin To: mingo@redhat.com, peterz@infradead.org, juri.lelli@redhat.com, vincent.guittot@linaro.org Cc: dietmar.eggemann@arm.com, rostedt@goodmis.org, bsegall@google.com, mgorman@suse.de, vschneid@redhat.com, kprateek.nayak@amd.com, zhanxusheng1024@gmail.com, neelx@suse.com, chjohnst@mail.com, mproche@mail.com, sean@ashe.io, steve@abita.co, linux-kernel@vger.kernel.org Subject: [PATCH v4 1/5] sched/debug: Protect lockless rq->rd access in print_dl_rq() Date: Sun, 9 Aug 2026 21:58:08 -0400 Message-ID: <20260810015812.428999-2-atomlin@atomlin.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260810015812.428999-1-atomlin@atomlin.com> References: <20260810015812.428999-1-atomlin@atomlin.com> Content-Transfer-Encoding: 8bit Content-Type: text/plain X-ClientProxiedBy: BN9PR03CA0077.namprd03.prod.outlook.com (2603:10b6:408:fc::22) To CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:183::5) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CWLP123MB6607:EE_|CWLP123MB3891:EE_ X-MS-Office365-Filtering-Correlation-Id: 6cf1f8f3-43e9-4d53-9349-08def682daa9 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|366016|1800799024|376014|7416014|56012099006|10067099003|6133799003|22082099003|18002099003; X-Microsoft-Antispam-Message-Info: sFpDB7FmcQB2CoYBCAVJwClew3gx82nRC0Oe9yzBtngQU3dZ2x0LNe8V1k/I4RUbr0g3NZfcA8pf7IEd4jeE9vM6McUBEcJZOD4NKL5X/2ToLxuJixV4+2ICS+m4MVlRqPhG4jdHry0ZT+C7cZ4GhHy5YOZd5b6eBdQ+vrFstVcHcCXmS6IzIiUzkrDnOXW1aXB3N2631HLXv8QvxEBEbfRX8FEfq42qXSISq/CV6IbY/CBZu0szVJcCaG+oGCYFNFkEQxXbCI6CqzO5Z3/d0j6erIetJuHbgowznymGmOG++IqIIIq4Mo/65Y9HDJp8mzZ5BnG5f1npX0Ar+mdyRIdkwolblqOYRB5DkhWl0bTHxlufS9H/XtyDCyJT9rsofPWPllt+EH6DUwteO5ckdnyJUKHsOW3twd2rzteSwUujvC1G3LZfRwAO+mtsUxL4JXWTk4BArYmfOEsv/IOXn7iiwD2v/XzB16VR+30bfyXl2Da1FAZKqMyVNpjsADcHNW4/N3aR/nWAzPzN6E7Xptr2zsg6oq94xAAPlBm2czpqjMm12TWrIS3WFzsyFP1/7ADNcmc0v22B/NwGmplSHjG49ubQKl9lFXxUQuApbthTYXpYO3ae4dGZaciV4mVRLn5iszLIcXuh+IKhCh1OxWr1YzNSrv34ZRPunKKGSt8= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(366016)(1800799024)(376014)(7416014)(56012099006)(10067099003)(6133799003)(22082099003)(18002099003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?w/OU4W/0mXvxg6I/BuQor7ERvRcK0Vo7G6G9osttnWH/73nOFgQASrIHmEuX?= =?us-ascii?Q?WvGwEvoqMpN1D64dKd/V+wwVnlahqrvU2LLZkrE+WgkcVcKaDShGJ9tXjdUe?= =?us-ascii?Q?VqYyxHQ6PSULxpy8XQGiliYsUS/jCQ9iTIw4ZnzZHUlZN9aD4Yuw1nVIxbHp?= =?us-ascii?Q?nFs75xC8hz8jTXKthTlzWM9Hu49mzlxTTS1No+qmaD844GQFTVjFIU9dAZZM?= =?us-ascii?Q?J7Wa2/a4AcnanaTYbCAMuHE/UVUPICZjTpbszK1/Lq0wVPB5KJsByzKj8EHV?= =?us-ascii?Q?wRNfoojQiD0Ol/93tsR9I45V6TSuxi0saWtQv7LZN57GaeNcKR2Bv2uyzn8C?= =?us-ascii?Q?9kxOoV9njLFMjZ2ToUW3mgEQwltYpCx8kg/LZK6ke0GUVt31CSbmP4xDfnd/?= =?us-ascii?Q?C3yjBT+3MFS4mHgqj896w+KZ7Fbt2SSEeb4oaL9W4SXw08QiEB5cO+uA3xGE?= =?us-ascii?Q?TAZU0Hkexl1Khy0OowK+mjL+SoPryCE2ufAR4BZqakpvmoyxfIUq4BgP/Osh?= =?us-ascii?Q?hDB37QatggcEKlHrjEL2SYlACKvOaJtGY8G/OWXG8EiFHcAX1c10EfXDJnay?= =?us-ascii?Q?K3pSxk4Z3bxq7ADX30NEcmXRZxn1PgM2IKCpRBORnGRiVDxWjjrD6bdzrM5m?= =?us-ascii?Q?EKN3jdFMVj8CjZvqLfQ0i6EtEmvw0QQF/eIzyL9CW6TDMIAxZsBXZQ2qhtt4?= =?us-ascii?Q?ns+mQH/OSrORwMWWl7mRjIROF7mTbDcohigCpsBDSUiW9TZatPpTVtwgPAMI?= =?us-ascii?Q?6Reuw2JFE5Om7nyylwnE8haTmI3+ffblLnWPAC+78PvhPLpmq1sq9CV3+tk2?= =?us-ascii?Q?tdWo8TfgNcfwWkHTeeVWDFPNFbyXkcB9HwIY7hVoh68aq0WTuKOs0afo+1K/?= =?us-ascii?Q?Os/+74BkwBtKo0kkF+1IXZXVm0ezm+AKMDTM5CRC6LRPTP30daBCLkmg195/?= =?us-ascii?Q?WBZfiEn+ySzYx7Vul6gg+cbrrJR8BcAIszABSVsQOAkdon0czCNO1nrFTDGB?= =?us-ascii?Q?mjXIVIOKZUd8Hx6rQe9Qcl7uyc/xHzTicyg1F/79UyOoz/btozMN/tZbcqbK?= =?us-ascii?Q?urIXLdBobvEpLM6lnlX3Koz5Jq6CdPxZ4+em5q7/aKthvYe4Hvp0mSj5EX9C?= =?us-ascii?Q?5QIWh2zfZYlpnghLOH7KIqvhjMLTtpmLsZecFqSgxh0lq8OYiiDXMsupcN8F?= =?us-ascii?Q?ebyGXf2QLfdbwYSfZwMhkSI32BJqUApuhTo+i68YrNIMVRlCJ2Tmp/JZ6XU1?= =?us-ascii?Q?/b+73qH61fTnsnrPrBzLncKd0dchsv1hGzouVDyejMgKrWjxlbelMT5LwhdT?= =?us-ascii?Q?itAFGPRsk1/9vlxS/j34QPpMEBvhRBaYa9MKEndndLB5S9eCT3dUkt5bvhZG?= =?us-ascii?Q?ul1PjMU3hIfEx6Ht0CYb7mnvo9L82LWZ6W7G2MgHxBmFBk4v3IkZDW069AJa?= =?us-ascii?Q?9GY79LZhE2mvzhptrlYqnapEi1rjs0r3+XUbiP2HAx186VivUP8EzhIVHQgm?= =?us-ascii?Q?EoKuCadHpr+3XaHWvzP93t/v7lh/JNhYTKgG13s+x2NVmqf7EVpOFw8L44yW?= =?us-ascii?Q?m5b/dy6SiQBeNdpJhgclQswoZ7GBFTXF8g/i6Tcee+NyNvcOXgSWaNqpIDbE?= =?us-ascii?Q?uyGJGiJyoIO9zUMFqn+qI51WVUHJIPxt/5XZh28aWTCGLhzmTrtgcDsQjZTi?= =?us-ascii?Q?BlwCe/tw0iuAvIK9dXrWRCno/x3Bq1tG6mqJc+GGKt84lAaILY5JnuoBmlxA?= =?us-ascii?Q?8oqj3mio+A=3D=3D?= X-OriginatorOrg: atomlin.com X-MS-Exchange-CrossTenant-Network-Message-Id: 6cf1f8f3-43e9-4d53-9349-08def682daa9 X-MS-Exchange-CrossTenant-AuthSource: CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 10 Aug 2026 01:58:20.9774 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: e6a32402-7d7b-4830-9a2b-76945bbbcb57 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: GsxcYmpd6HAIswYBlljLEqn6RAWAilt3Vir2Jl/CB7ROPd8FXaCzXnVGOSL0Jyhw/82h54i7j1KTRMuQ8Ffe2Q== X-MS-Exchange-Transport-CrossTenantHeadersStamped: CWLP123MB3891 In print_dl_rq(), cpu_rq(cpu)->rd is dereferenced locklessly to display deadline bandwidth statistics. During CPU hot-unplug or cgroup cpuset repartitioning events, partition_sched_domains() calls cpu_attach_domain(), which executes rq_attach_root() to detach the CPU from its root_domain. When the reference count of the detached root_domain drops to zero, rq_attach_root() calls call_rcu(&old_rd->rcu, free_rootdomain) to schedule memory teardown after an RCU grace period. However, rq_attach_root() previously updated rq->rd using a plain C store without an RCU publication barrier (i.e., rcu_assign_pointer()). Without a release memory barrier on the writer side, CPU or compiler reordering could allow the new rq->rd pointer store to become visible to other CPUs before the initialization writes to rd->dl_bw are committed. Furthermore, because print_dl_rq() did not hold an RCU read lock while dereferencing cpu_rq(cpu)->rd, an RCU grace period could elapse concurrently while debugfs is reading the file, allowing free_rootdomain() to execute kfree(old_rd) and causing a use-after-free race condition when print_dl_rq() reads dl_bw->bw. Resolve this by using rcu_assign_pointer(rq->rd, rd) in rq_attach_root() to guarantee a release memory barrier when publishing a root_domain. Finally, fetch rq->rd using READ_ONCE() inside an RCU read-side critical section in print_dl_rq(). Fixes: 02968ccf7b80 ("sched: add /proc/sched_debug file") Reported-by: sashiko-bot Signed-off-by: Aaron Tomlin --- kernel/sched/debug.c | 12 +++++++++--- kernel/sched/topology.c | 2 +- 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c index 40584b27ea0c..2c2156dfab00 100644 --- a/kernel/sched/debug.c +++ b/kernel/sched/debug.c @@ -1081,6 +1081,7 @@ void print_rt_rq(struct seq_file *m, int cpu, struct rt_rq *rt_rq) void print_dl_rq(struct seq_file *m, int cpu, struct dl_rq *dl_rq) { struct dl_bw *dl_bw; + struct root_domain *rd; SEQ_printf(m, "\n"); SEQ_printf(m, "dl_rq[%d]:\n", cpu); @@ -1089,9 +1090,14 @@ void print_dl_rq(struct seq_file *m, int cpu, struct dl_rq *dl_rq) SEQ_printf(m, " .%-30s: %lu\n", #x, (unsigned long)(dl_rq->x)) PU(dl_nr_running); - dl_bw = &cpu_rq(cpu)->rd->dl_bw; - SEQ_printf(m, " .%-30s: %lld\n", "dl_bw->bw", dl_bw->bw); - SEQ_printf(m, " .%-30s: %lld\n", "dl_bw->total_bw", dl_bw->total_bw); + rcu_read_lock(); + rd = READ_ONCE(cpu_rq(cpu)->rd); + if (rd) { + dl_bw = &rd->dl_bw; + SEQ_printf(m, " .%-30s: %lld\n", "dl_bw->bw", dl_bw->bw); + SEQ_printf(m, " .%-30s: %lld\n", "dl_bw->total_bw", dl_bw->total_bw); + } + rcu_read_unlock(); #undef PU } diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c index 622e2e01974c..b411cc00029c 100644 --- a/kernel/sched/topology.c +++ b/kernel/sched/topology.c @@ -496,7 +496,7 @@ void rq_attach_root(struct rq *rq, struct root_domain *rd) } atomic_inc(&rd->refcount); - rq->rd = rd; + rcu_assign_pointer(rq->rd, rd); cpumask_set_cpu(rq->cpu, rd->span); if (cpumask_test_cpu(rq->cpu, cpu_active_mask)) -- 2.55.0