From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from LO2P265CU024.outbound.protection.outlook.com (mail-uksouthazon11021120.outbound.protection.outlook.com [52.101.95.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 94E7232C942 for ; Mon, 10 Aug 2026 01:58:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.95.120 ARC-Seal:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786327106; cv=fail; b=Y28X/nZ/lEDtS2G6MglqryUKH5Ak0yzirab47a2mjJm8Xvr4H7n+Z2OGeQwxF2OqBh/SuIuCH+vtlyvfShxLg/SksTdNJ7P6tptjMJ/FOTiRJ84F/Cyz6UmeJlJCc2bhxuI8S1/TPtvCiF6KadhvY1V66m4JeouWn2KCYLaznMk= ARC-Message-Signature:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786327106; c=relaxed/simple; bh=HG1ypNQpdIgosqco8d1VqFNnaEbA2WcvprNw+k+WKj8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: Content-Type:MIME-Version; b=IWQ7SBQnOuGbI8K7ZCb5ncsWVoJFOmj8c60iospqBUT4EOgTTyVbgbXg0Fd0kCe3YfpmD70JsHUsK+q36aOtOTgy3ogVA4crcJ6Vg3UVtopSLmj0XcWfsG3L7XgckZaNLy6mrNfgtGc9LiAP4+ZIUeI6zDwBLW5Y4NmJO/oCnHg= ARC-Authentication-Results:i=2; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=atomlin.com; spf=pass smtp.mailfrom=atomlin.com; arc=fail smtp.client-ip=52.101.95.120 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=atomlin.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=atomlin.com ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=Uj9OtNI55oMyF8q+zocnqT/O8OSJ7RNVwBaheHpvam2CKSV29hAXna3CX05YP0MfkZAnUAn66blQCuZEDwFTSzEiInd6+c7qXE2xAZ2l/a4d/NNAX8CCN3Qslrh1kuV7e3kzd59pVX1Vdd657zjp9nz45cDO0KAH89LNn6gtqphsiFzEY4KYaT04fcUVX684c9jBrVOOtVN76JqHcRQ3MKzAzIz/O3c8yUZCKXWin0v0Bnnzy1fVdkfVMxmHteeQlQKeXkt9QnW2BlVGNk5gN+eKCzmjEf6FxgcZ9+wfSDe3w/TxbkPL1BL/ZhFgBjtN8in/lkvS+76Um3JMEc2rUQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:MIME-Version; bh=ITE4uq/ThmNPeKddhnSe4/gZmtHxhdB14LkOWzoiZUc=; b=WZ+9cqtAhF4gebcRhbYE2YDEV6cebOC+EdTluXd7XuYfIkr5j+0lWKIJ3yjDQjYG9Q59J9L3/xLB2xYKiqnNfuyhXqun2bTY2Fae67ZweM1cZLNwAUMdmuhiNUUrslrxU2XVVBpbzqKJFtodtLR78tsn+5qHiF1fsIbymrjU1f1TvNwJBaJq1IE5Ju5fcHwdpIexs2nX220vvA7Af0F+AVSlrN6N1aHOmR4E1rPbRw3rdzJwE3Kqb8a7mSmqkoeAbtrx/0UTRGroIraOL058t06ieJ45RHXNWlPCKbR0HMGgrca5hzdszegKMD/zg3RDQYxMJQ6Uc/r1kB1KwI4/Kg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=atomlin.com; dmarc=pass action=none header.from=atomlin.com; dkim=pass header.d=atomlin.com; arc=none Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=atomlin.com; Received: from CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:183::5) by CWLP123MB3891.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:a2::6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.292.25; Mon, 10 Aug 2026 01:58:24 +0000 Received: from CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM ([fe80::cec4:77ab:262e:d230]) by CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM ([fe80::cec4:77ab:262e:d230%4]) with mapi id 15.21.0292.024; Mon, 10 Aug 2026 01:58:24 +0000 From: Aaron Tomlin To: mingo@redhat.com, peterz@infradead.org, juri.lelli@redhat.com, vincent.guittot@linaro.org Cc: dietmar.eggemann@arm.com, rostedt@goodmis.org, bsegall@google.com, mgorman@suse.de, vschneid@redhat.com, kprateek.nayak@amd.com, zhanxusheng1024@gmail.com, neelx@suse.com, chjohnst@mail.com, mproche@mail.com, sean@ashe.io, steve@abita.co, linux-kernel@vger.kernel.org Subject: [PATCH v4 2/5] sched/debug: Protect lockless rq->curr access in print_cpu() Date: Sun, 9 Aug 2026 21:58:09 -0400 Message-ID: <20260810015812.428999-3-atomlin@atomlin.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260810015812.428999-1-atomlin@atomlin.com> References: <20260810015812.428999-1-atomlin@atomlin.com> Content-Transfer-Encoding: 8bit Content-Type: text/plain X-ClientProxiedBy: BN9PR03CA0077.namprd03.prod.outlook.com (2603:10b6:408:fc::22) To CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:183::5) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CWLP123MB6607:EE_|CWLP123MB3891:EE_ X-MS-Office365-Filtering-Correlation-Id: 1d761c68-1ca9-4145-67b5-08def682dc85 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|366016|1800799024|376014|7416014|56012099006|10067099003|22082099003|18002099003; X-Microsoft-Antispam-Message-Info: /+p3/nr6QRyZvnLyIoF4v4uUOdrE4HixF5h5fYf1i5pKsVIUYWH3yUn5GIWdIDDLJKPYIkIxgzZNpOB1coOmMyrtmJmBaIBf8cp6yKZYU6NjB5WAQUyUeVczvxKZGxL+zlJamrz/WleJtsvuSR+4H4nBmSB5UECrbKUgwT26dpg91+ocrH08/IRs6oK1PWJLHmKKp6JMVMVIYXeK4ziYG3rJud3AmtyA2L0TcL203dXaGus+yh33XcorKaJ/z3GO7XzgzvCmcG4Tl06mMuydY55kZ9UcKj4MUAIxJZ1N1bibe1ijJiwlKuLr8EHsaWP7/YWeMyoTsSC13yTOPe+V2/ZzMNL5EAq/b4PD9eem9BGMPjqP6icohWB3+8/yXY+KptXgm+aV5V0d3FtrF341LsG51gaKyV43kIT6Rv4Dc0Ui05b7YdXT2PgLHPCPjC3gZP+7U8dVGVObnIRB8wU3CX3z1VGQoU7e6Rd3teUdDtDcYJ/ftMaicqsqXlcj5n7dgEbBy3k1cmSFzYTr0WO7VsLVf6mbXJqoiVCJzqaUhvkGjRXsf7SGp32U1yOiiWjEwkOYrHLfpNSvCVcxe7LovtWu9Tkxt3FIu/MJ0iK0GSGPdXEp6KMCyZHNt1HZ+YAS9L/xROsywYQyIb9bUhzQVM7h6pLV04wACSMT3Vw9u08= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(366016)(1800799024)(376014)(7416014)(56012099006)(10067099003)(22082099003)(18002099003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?iKIsOjpBem672AisfbcUiuuVG5gv39uL70A/XjnyudRdRmoGe+EjfaqJPogH?= =?us-ascii?Q?ZifZss2hGgh0MfT007TyvteYso43RBg/AJHGVwCHPlJ2BEu64xsQh7MsycQD?= =?us-ascii?Q?ngMjQ7FZd/k8m1lkul7RPJ8LchwgUoO2u8Cj9nHY0PqdO9EGRI3GTuHAXZLV?= =?us-ascii?Q?oLj9wXGZDWz1LWbyfZ62cS/U+VYig35oLr9Z1o7mrBNGdtqDUXtZBsR7Ei8E?= =?us-ascii?Q?KlYJeBkq3mgPIUXS9j1d18y5j2t1u4YbvWIWhqoajZ1J9S9r34W3JQlWHXJt?= =?us-ascii?Q?pbOrXKamhK499rCqfifFwLQe7JOl69nfJ/EZdGtfEazuxTgflz1SkkUBi09S?= =?us-ascii?Q?0P1aeShzZimTvJc3akuiozqWnVnGq23+xUDEiCIL6BYGImPVWW1qShYHqWcj?= =?us-ascii?Q?c3uy1blihOyIkk++eX50aodlvF5QOgMACdkIbDqih9pDzdkuMaJ8Oz0Ph0fu?= =?us-ascii?Q?kBDHgJZr3Jf0WDnaWoY9b2MrECcU3d6NXu04PyuR5XVeUIOOStTOuubur8fG?= =?us-ascii?Q?Ugbp7V7AY9Rh7yNoAOCoomRGmXDmKRcJmaZfOAh9xvKh1e21k8NSr+0YONe2?= =?us-ascii?Q?h0UqOuaaCft/7yoJLP3EVqfwXyYtk5jW1qkBUGo6ppxt0Anu/hAZcWPUkXIt?= =?us-ascii?Q?uYv01pSafztj3AqefRsvODBHIkRuCvcRcsnPjsrCYXLaBNWX+zp4/9QsoisK?= =?us-ascii?Q?92uF9lQiIRY2HYoXbjZCLksM5EhTG6Yd/S6paqO2R1rAvregKOY2DtuXAqeY?= =?us-ascii?Q?SALdUxsyxRtWgxyA7HO9p7hNfVHFVdNm2XeLTpMCrz7vYCLUXqFKvAB8ZvAX?= =?us-ascii?Q?DX/SEo8QKh+EmEYKyGMOl4VsZ5RPV0NY4zHUXsF6f7/tZZ8z/DRgfrq7M+xo?= =?us-ascii?Q?6W737Lxlt5LP7yg3TJlAV7vd6rcJ785YGGwAvSCFYrBEFeK4NeuO7nNU+2v4?= =?us-ascii?Q?pC0TlUUuqIDN9x4GD2cEA06EXLMjleZg/JRy0yqzmk5eZMRUQs0Ew0uOTN0G?= =?us-ascii?Q?kTnn9gW62CPJ7ZEolUPPm+/C+BSD5GU43M4ma8DDiOPS9jZfbQ4H17iY8l0w?= =?us-ascii?Q?RLOfvvceyYc4RO4cqlPLlDslROKZ5RnGyWdwnLPjQWmCZ9WtZ4rhMR+xtJv+?= =?us-ascii?Q?SXq9gcW7RqOPA9p+WP+GT9bslD6FsE5Q47pz0kUVGOLl/x+A5S9QW2mkRiqA?= =?us-ascii?Q?/OAwxaUJ+6OifUSK71NtV3M9RkoB6jcKwB+vvsyyj7F3gBmSDbxYHvfCyp/Q?= =?us-ascii?Q?DqGpfeFlpfF9dxrvGcOA/IROUCIuskMp8Nn51m8NliuEVJtdgRxZKYlwDuzZ?= =?us-ascii?Q?jTH/3M2jlh9FTkXsATcBm2DAdsGaCblTi1VvzN/Ib/pZNuC1k3bbF6+DkyJ5?= =?us-ascii?Q?GuTXFu41NrJFj0p+wwibPsPByHA0jko3wfvaBhR/O4sKWF7tK9meU7gaEVxA?= =?us-ascii?Q?yfP6wiVxFcqP95zLJK/JbyMdlVFSReL435uz0n+4WhPxEmNXPUJzBr7UVaz7?= =?us-ascii?Q?UP13nvTsRRq7tYMVSBI2/umexMGvc3ckPxNV0zMSpX2tEC1rj4B96B43wLco?= =?us-ascii?Q?Qtm6LN5PoGjxzE0zTO10yTVpr4xTKO1yx3aB278dr1kxDCjby6XQuqmwZV73?= =?us-ascii?Q?5KVVGOp/aEff0lRYr5ky2RcHDbxYYZC+sNYzEoEOF7ViXcwIKLejuWX0Kegv?= =?us-ascii?Q?J1OrtXZfPDI2tJbLeVoMdSOLf11ipbPuMC/0/i0LDwWQgQUJizfDe2c20tqZ?= =?us-ascii?Q?H899YDtV3Q=3D=3D?= X-OriginatorOrg: atomlin.com X-MS-Exchange-CrossTenant-Network-Message-Id: 1d761c68-1ca9-4145-67b5-08def682dc85 X-MS-Exchange-CrossTenant-AuthSource: CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 10 Aug 2026 01:58:24.0191 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: e6a32402-7d7b-4830-9a2b-76945bbbcb57 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: eo133kfts5CTpSRUylh9G7aVipkDo08MF+V4w2LWS6RjMo+euzP4Tw7acUmbARjf+tDkWP67vjqi6PungBtZpQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: CWLP123MB3891 In print_cpu(), rq->curr is dereferenced locklessly to print the current task's PID via task_pid_nr(rq->curr). While accessing /sys/kernel/debug/sched/debug is inherently best-effort only; rq->curr is indeed expected to change dynamically while print_cpu() is executing. However, if the task currently running on the CPU exits concurrently and its reference count drops to zero, put_task_struct() calls call_rcu() to schedule __put_task_struct_rcu_cb(). Because print_cpu() does not hold the RCU read lock while dereferencing rq->curr, an RCU grace period can complete concurrently and free the task structure via free_task(), creating a potential use-after-free race condition. Resolve this by reading rq->curr using rcu_dereference(rq->curr) inside an RCU read-side critical section. Holding the RCU read lock delays the invocation of __put_task_struct_rcu_cb() until after rcu_read_unlock(), ensuring that the struct task_struct memory remains valid while being accessed. Fixes: 02968ccf7b80 ("sched: add /proc/sched_debug file") Reported-by: sashiko-bot Signed-off-by: Aaron Tomlin --- kernel/sched/debug.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c index 2c2156dfab00..c3409166a288 100644 --- a/kernel/sched/debug.c +++ b/kernel/sched/debug.c @@ -1132,7 +1132,10 @@ do { \ P(nr_switches); P(nr_uninterruptible); PN(next_balance); - SEQ_printf(m, " .%-30s: %ld\n", "curr->pid", (long)(task_pid_nr(rq->curr))); + rcu_read_lock(); + SEQ_printf(m, " .%-30s: %ld\n", "curr->pid", + (long)(task_pid_nr(rcu_dereference(rq->curr)))); + rcu_read_unlock(); PN(clock); PN(clock_task); #undef P -- 2.55.0