From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from LO2P265CU024.outbound.protection.outlook.com (mail-uksouthazon11021130.outbound.protection.outlook.com [52.101.95.130]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E7D2E32B103 for ; Mon, 10 Aug 2026 01:58:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.95.130 ARC-Seal:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786327111; cv=fail; b=R2jzeYLgSmCyRq0xpB41KIfr02FAYhCBXH0BD2Z8owDSUUnsSSiLBuS7mhgiMwtYW1PrLdKRQTg4TS7XZg34ugL4aH7Lsyw24e4Rf7ARc0iv7QqUayV+b8T4KPo+PZ0KZEbQsyejxr4dk52lSeLjfyT+fDREReuscCcoqiIkYy4= ARC-Message-Signature:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786327111; c=relaxed/simple; bh=O4ylhg0jO9CdRQcP2zmSZJd3wm5sHRcFfz4fNiwAFbA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: Content-Type:MIME-Version; b=VvMi+x7CerILtos09Jg1+k1ilNIL72cL7FtUuDmuGwI0x/keAhh/asT432JaG/7pQoGwAy4EJWWMjsVFS7hd4FpwnE+aub05pCl/7GTMStvyaVZNK2SwxZIroT8/S2dMiyAWyOVKV7tLHAsXyma8TXh2VWJ3h7dOiotHR/kb0LI= ARC-Authentication-Results:i=2; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=atomlin.com; spf=pass smtp.mailfrom=atomlin.com; arc=fail smtp.client-ip=52.101.95.130 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=atomlin.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=atomlin.com ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=M4TgHQX9KfON5Cgwf1DcpCzi8FBoo4nM8p4HRgBbqITPEw57/Ecs1TyktPPFK4egu8guPLEeMpSPyUEbxv+TpB1h8kZxDCDcvgNKF0zJSaL08aF7P43/Fyk8u83uxTlb+wTjj11sU/0CvM2k6ZUv+LdtTKQF8FcN9tbPLSe1qfjGsVfPtHwgF95Mo98MLIxyuLymlpTlAKAthIAzi4nHi3tzdcNXqbaNl3jUXg7lK/QPQURsSAb7r+iggdfyvvb6xwXnjnBkWv9Z9GboIvD9NaGvresSL0ir8xVIpJNK2HEFCEIo1aykGLQZZAy3y24X0V+xAutNeuXDYj3FH6sHZA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:MIME-Version; bh=0ittPCAKKX2nPJZeF40nU2v9TYMA2hnM5o+JVMaqmPw=; b=ki17nLPzTKmlbG0OcTTHa3XTC0ZgiGj4k6y1lhAqcpGiAucNK9H6MQXqlM0VrEONETYNxJIVKMMRMnNjraj0AiOYVk39UP5X3HjkObXUIYNdIxnJgcfBayTP04CX/VUvQLhh8DsJgyXNpr8sT3ARC0cLNaelTATunfouRSmFbJBO3gCCAG8PMovkcQcOfaDyrTpzw44l9CZrvBFKCvJR32bzhND9kovDuruWSRsrU5BFp/763V1vmcujfGnni90Mfkib8ZTngVNUnpMFBS4Kba6LomUH6+kMazHxZROAsa2fLv0FF8nIPMNnaZm7VtGsNw6od/7HDDj/Rq3IjqAe2A== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=atomlin.com; dmarc=pass action=none header.from=atomlin.com; dkim=pass header.d=atomlin.com; arc=none Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=atomlin.com; Received: from CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:183::5) by CWLP123MB3891.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:a2::6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.292.25; Mon, 10 Aug 2026 01:58:27 +0000 Received: from CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM ([fe80::cec4:77ab:262e:d230]) by CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM ([fe80::cec4:77ab:262e:d230%4]) with mapi id 15.21.0292.024; Mon, 10 Aug 2026 01:58:27 +0000 From: Aaron Tomlin To: mingo@redhat.com, peterz@infradead.org, juri.lelli@redhat.com, vincent.guittot@linaro.org Cc: dietmar.eggemann@arm.com, rostedt@goodmis.org, bsegall@google.com, mgorman@suse.de, vschneid@redhat.com, kprateek.nayak@amd.com, zhanxusheng1024@gmail.com, neelx@suse.com, chjohnst@mail.com, mproche@mail.com, sean@ashe.io, steve@abita.co, linux-kernel@vger.kernel.org Subject: [PATCH v4 3/5] sched/debug: Protect lockless p->mm access in sched_show_numa() Date: Sun, 9 Aug 2026 21:58:10 -0400 Message-ID: <20260810015812.428999-4-atomlin@atomlin.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260810015812.428999-1-atomlin@atomlin.com> References: <20260810015812.428999-1-atomlin@atomlin.com> Content-Transfer-Encoding: 8bit Content-Type: text/plain X-ClientProxiedBy: BN9PR03CA0771.namprd03.prod.outlook.com (2603:10b6:408:13a::26) To CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:183::5) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CWLP123MB6607:EE_|CWLP123MB3891:EE_ X-MS-Office365-Filtering-Correlation-Id: 56adf933-ffeb-4f26-cecd-08def682deb9 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|366016|1800799024|376014|7416014|56012099006|10067099003|22082099003|18002099003; X-Microsoft-Antispam-Message-Info: 0oR1lfAm4qzAIHKaKwt2wa6+/DXA8UhksRDDZPZ9wEVaApaeKJ0wMoVArsE5Ql5HTaaLtPrq2O94p5vSAGLt58WpEmI5UBg9Dn8TdGgrb/Xy3ae+dH1mEOuOC9h7mXRcwW4oLFjXIkZx/ASAnZXYxK/UNUE2pDscZdxzkeZh6ckdSIRxNO5x4A12APXplBN8ms2AqJVA2qN6neLYZJf+A+ojDfEnkURavDIzFMwDZ4MCLUbOtJacvsZcKfSgZ5wMVB3P6h8OtBlnX8btAbfib9WG3eph2sEHndB2ceO0UgAJdTCAQyv2eDIkVIdlfmft4exB2hPvE9oej6SEF7vsTsOOrWHZv81oicUSa4UfUsq+FZQwqJ26XjYJ1ROGHoe6UeJlb7/VIyF1IsXgjCUCAI15PZHpYvd9K4w/4WEYiuBLdjNt3q1b5xCb0qxMGZ8JRvZQA4o1QMFpdhEuUdF1uKtgGYHNa1mPq+YuFH1v42yBSGhzUVr4r5oBq03DSKgjP9bW3BPdN7/bKHnT1I+c19YBOfBh8OHnMCov2OPLHL1YB4JldwSCWUgLW5R17TC4ijpmPg16UukD1R2i7lTfxPHlPwQANK4xULNHLfgoWOoFtX+Er28Q2RFSSnzYm5In89JYVkN2Rf0x7wWLKjnOiYCRSBaZnfnUYVu4SXwRsHg= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(366016)(1800799024)(376014)(7416014)(56012099006)(10067099003)(22082099003)(18002099003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?sKKZdl/jsn1ghpv91wtNSXYx4h4LZOMYFVslT77t9z1/FuTrpQhjxbcMWV4J?= =?us-ascii?Q?RabyikW9nkDcBsxn8iUZ7U6xNbxIwT9+1msV+xjH4xzPc4PDhqzPE1k3uJfk?= =?us-ascii?Q?53+08WBHUDH4BToBkY9m1JB5RRGiRdhRyxG2XWgIHyd6wwfUAC2P8eeYtlo6?= =?us-ascii?Q?/tPnR8d6FnyDGx4EG75QZzIIMuz+ePShVsJvtLz6p37n9sRr3mzgjqQx9PAO?= =?us-ascii?Q?S5l4XRTEGoZ/6azlZ0pa2ufGQUNiBb+qpX43MnawCmm0EXuaK/LeYRIkKzcp?= =?us-ascii?Q?5s/tnEm9Qn48a5KhQfv2yzDXyKOaBYzSZaW888qgVK2+uihPz3lW8+eYS4iV?= =?us-ascii?Q?dTqfUD/lJhwjJcXWZoB6zY7xxSAM8lsPqlZhjlSFuKy+R6VPFQ89RBY5pL+M?= =?us-ascii?Q?LdefFkCo1qQ6BvhUfVRLOfhSGA18QU9fVs/+R45yErInetJ2Ctp9jNDsWrK/?= =?us-ascii?Q?Q7kHhjObrDnGWQZS2Vz4qde5mMQ78RnvTWU5ul7IlRLUEDTJuoL0UaoH2b12?= =?us-ascii?Q?sytLgtag0fxaTiW2DnWh+2dZ35gWd46kRhWqS3YbqFxB5WgamwFwoEK8hk+x?= =?us-ascii?Q?a2MMOwnTwabmsJprgi9ej6VxJNpzzc+0W+EnlDJ9Q8pTeWAV1yB/xqyH8sBu?= =?us-ascii?Q?/4HRDrvjrER3pTbnwh7dHrJCmQyqGDOxD1G1HVRcWv10x7xRaZQfIo57pKja?= =?us-ascii?Q?ZasB0ATfDg1E9aSMXsmeZa2bQm7a1g21nAdSRiDoGZXjGpU3UMD7QO1JqfnM?= =?us-ascii?Q?f1bGuySMfjKZZLoKYpAKq3a9eoHV9yknDq5Tq/aY3dgi9JRblFDl0E8lhbGb?= =?us-ascii?Q?lcBxnoLVwx7bNutFTcJidWCTFWL62UbMju4uf6k4BSOCi3b+/j4mODFk878V?= =?us-ascii?Q?V5HzSKiYRYVJqaTTZZywQPDsmpOEuqnDBg1TxO5J2yywCKyQn0436LfNNKYL?= =?us-ascii?Q?C4Xoarzrj/Uybaz+hLuhWtPYFk2PD+iHRwDMNv0Jh/oFJPstr0EQaZNkgISV?= =?us-ascii?Q?zQZfAjSkbtDBlCMcc0wG4RzsdQhRkbSJNHWBcs9XQqajVbvK8B/c62+6shEU?= =?us-ascii?Q?jtZhFWMlvHdP7wxwwJ0upNUbJVG8BKD7CTpUozZIQmQro78yMVj3n6L3igwc?= =?us-ascii?Q?rd9rXvRxwiarzLrD2DuG6V62ncSAFW/zieB2MqCWqnkoVjjfoISwklmhhO4b?= =?us-ascii?Q?1CrkKK/vj0Usc3r/q2O9TcwIfI1N16RSQOLa346IYHbZtMv8899Fl729lhTb?= =?us-ascii?Q?fW7B53eO5UZcb3U98MbVua6I3ahsKzv+C9ah+PIG+xZSmUmZ8VP88br5lpUR?= =?us-ascii?Q?VUHcXfGkG4tqqeTrU3D90Kh4mwGEFPpW0DyNZTgFeAetwcAg1I1vFwVRLQ75?= =?us-ascii?Q?n5qHl+AW2bqtmvncjoCM+nOKEp0KtM5/xb7eCi4oEF066ggPQgzFOAErhf9W?= =?us-ascii?Q?75FaELwM01YROu349uNYR+AAAQZHKYYAR15Ie4qt7wMSu8Lh44Y/b+meyeVg?= =?us-ascii?Q?FblZ+d0SP1bPKX+mgtN6piDuIpo2yqO7NrBncvELSopJByAA5nVYhWm9aLKX?= =?us-ascii?Q?03Us0Z5FaB4gMDliWfwU+I3CUmNK2Clo5BwZvLw2vkiNj3c5lgDRi5KRhCVT?= =?us-ascii?Q?1LjI3PkXiO5Q6tdyyZcGRYfRXaqXzOdx9rbF1rHCfuKynSU9u1XJ+I9wqx8U?= =?us-ascii?Q?J1lr/ErFArytqJDfY+/Jy36soZSXurQ3ofGeKKsw8kCj8yFyC2Ng0hd0lq3t?= =?us-ascii?Q?Y2SiDJwoxg=3D=3D?= X-OriginatorOrg: atomlin.com X-MS-Exchange-CrossTenant-Network-Message-Id: 56adf933-ffeb-4f26-cecd-08def682deb9 X-MS-Exchange-CrossTenant-AuthSource: CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 10 Aug 2026 01:58:27.7070 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: e6a32402-7d7b-4830-9a2b-76945bbbcb57 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: fN7YsO0Pw/a96hR7AXTFGuppuIP3rwe8UM6BbeKgZAgrWQG2ZRL3QgM8QalpRmIyJGB1tCiZSgAvyOMW8pAUOA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: CWLP123MB3891 In sched_show_numa(), p->mm is checked locklessly and then passed to the P(mm->numa_scan_seq) macro. This results in a double-evaluation of p->mm. If the task exits concurrently via exit_mm(p) between the check and the macro expansion, p->mm can be set to NULL on another CPU. The second evaluation then dereferences a NULL pointer. Fix this TOCTOU race by reading p->mm once into a local variable using READ_ONCE(p->mm) before checking and dereferencing its numa_scan_seq field. Fixes: b32e86b4301e ("sched/numa: Add debugging") Reported-by: sashiko-bot Signed-off-by: Aaron Tomlin --- kernel/sched/debug.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c index c3409166a288..f5494e02f600 100644 --- a/kernel/sched/debug.c +++ b/kernel/sched/debug.c @@ -1317,8 +1317,10 @@ void print_numa_stats(struct seq_file *m, int node, unsigned long tsf, static void sched_show_numa(struct task_struct *p, struct seq_file *m) { #ifdef CONFIG_NUMA_BALANCING - if (p->mm) - P(mm->numa_scan_seq); + struct mm_struct *mm = READ_ONCE(p->mm); + + if (mm) + __PS("mm->numa_scan_seq", mm->numa_scan_seq); P(numa_pages_migrated); P(numa_preferred_nid); -- 2.55.0