From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from LO3P265CU004.outbound.protection.outlook.com (mail-uksouthazon11020130.outbound.protection.outlook.com [52.101.196.130]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F39C73446AD for ; Mon, 10 Aug 2026 01:58:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.196.130 ARC-Seal:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786327115; cv=fail; b=Q8Al8uJefm7hFqMaKQ6PIR+9evMKxer02W0/tP5eGNzBvV6/URy+98G7/+lvjkj6xrEhmavWH/1zukGjm0R4SITKTNIv822vtiGbaNcSKhfBcqe6VDEjAtc9EnvqvtxHgKlxQStr7o3uUckt+OeuJolnHqt5nXNJyZcKvEjeH2U= ARC-Message-Signature:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786327115; c=relaxed/simple; bh=VOXfWM2MAvF6d3MDQAclR8qEoLL4sfqJG/9lOeVJJlY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: Content-Type:MIME-Version; b=ttFVmK3SewH2CxzILL/2938KyVkfMP+608RSv0x3NlwbL3T2UCjlkKg/0w5GUe0JSv/tNOOz+33QNNAQsXvTXPzJ0SX8RQoxw9ro/Lp5MEDsnZ2vo+jr+65CHcBxUo1eKnxKXvUyH+JKZYg40HtR6S8zdJN+wJC6ERPbUWMeNUg= ARC-Authentication-Results:i=2; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=atomlin.com; spf=pass smtp.mailfrom=atomlin.com; arc=fail smtp.client-ip=52.101.196.130 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=atomlin.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=atomlin.com ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=cWoEokDDh6y1o9VfGPivy12X0f99Tb4gIUGJjJ6tJnZm5meTXyIHPKcWOEt0Pt9ExkkpRRjex5URoR8p9Wwts9h6nj/fEcxur38o8Ik197Us7aENln6oIJ6VfMZf37+isbRTabM2o/8Wc7M3YjHymJyLPlwU1Tx4aNoUdBVuq38hZ0r8lUw6ebby8GwxrCiRqU1SO4bedAiSRYpjDzvOVO7tz+QaqiiVSYiQ5JktrFraTuhh3HfPhwrxC3+6NDj2SVIq45tmyBokxyb6Q2N+qlub2cZQSCvk9H7z58q1B1w4OwR1Lps17wl+VHIsc5rekTG88djTNDtpaH7iXfxF0w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:MIME-Version; bh=erdgjFmNbMzu6QIzuSEh9B7yp4xX4jw0DimYdCH6ruo=; b=xtkksUVZtoq3QCjD8XVTAwb6bUpMBT7cQQBpfOHkxqU/ZWrcwP0FaFBRfDkW71eRNAlp1Hj+yHR4VzGlSyZr11wfVQNqJBor09SKKc1ye0MBaydUoevChZ84RmS4C3Cq2lT90vyVpO9zCxf/qH/Z+1ETcClT+OxH0Pj35saEOJ8lv5vduBnEyGzkRsVVPSxK9vBFdXFwbyIBnK5i2ZE5XSoKQeNRAoy5Et+b/TbRc02ySeuGZqehiGHDN+B28MXUD6TISrxQBwJYytBRukTCc6us1uMoZdkRAh3Oxa6U+HORvRCWpalH6cB3avZBotglqAqVM947cOmqJqV6tiP3EA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=atomlin.com; dmarc=pass action=none header.from=atomlin.com; dkim=pass header.d=atomlin.com; arc=none Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=atomlin.com; Received: from CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:183::5) by CWLP123MB3891.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:a2::6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.292.25; Mon, 10 Aug 2026 01:58:31 +0000 Received: from CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM ([fe80::cec4:77ab:262e:d230]) by CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM ([fe80::cec4:77ab:262e:d230%4]) with mapi id 15.21.0292.024; Mon, 10 Aug 2026 01:58:31 +0000 From: Aaron Tomlin To: mingo@redhat.com, peterz@infradead.org, juri.lelli@redhat.com, vincent.guittot@linaro.org Cc: dietmar.eggemann@arm.com, rostedt@goodmis.org, bsegall@google.com, mgorman@suse.de, vschneid@redhat.com, kprateek.nayak@amd.com, zhanxusheng1024@gmail.com, neelx@suse.com, chjohnst@mail.com, mproche@mail.com, sean@ashe.io, steve@abita.co, linux-kernel@vger.kernel.org Subject: [PATCH v4 4/5] sched/fair: Use list_for_each_entry_rcu() in print_cfs_stats() Date: Sun, 9 Aug 2026 21:58:11 -0400 Message-ID: <20260810015812.428999-5-atomlin@atomlin.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260810015812.428999-1-atomlin@atomlin.com> References: <20260810015812.428999-1-atomlin@atomlin.com> Content-Transfer-Encoding: 8bit Content-Type: text/plain X-ClientProxiedBy: BN9PR03CA0596.namprd03.prod.outlook.com (2603:10b6:408:10d::31) To CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:183::5) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CWLP123MB6607:EE_|CWLP123MB3891:EE_ X-MS-Office365-Filtering-Correlation-Id: e76f9e3e-60b3-4271-4dd4-08def682e107 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|366016|1800799024|376014|7416014|56012099006|10067099003|6133799003|3023799007|22082099003|18002099003; X-Microsoft-Antispam-Message-Info: 5G9NJBFnbtn5okp32eIAftdjYk0oxm0QHY1vj5UEs4LxIai8zK3ThhhAyWb2I/M2Owjs6XUGJIa254TGAQ6PFb2LQXLq3Y3Kq5OzwxKyaKelyc/cPRLtsrgAcfEISAjtoEpM3SQVoYWNH83qKcjf8iAQSDMxI96kjTmWQev+KWCD0vM3PFOGbrj6ExEvsnWEG5cow0Q64keo+/6GHZ/FiECNewLo4hGUy7CTkhxfp4TZA+JLImtpBpkh6YkgMGAyWie3vWcSN98Yy0I2q12cSH4K0EvMHP1CH9+loNB0f7UeKuff1E8Nnr95rcBBcLN6LpeDOD2aY2ey7w7zBs5ZSXvQFnWKshcrsb1d2Ecyi5YhCKJEPTGRWi0zRCsCXwvRzBHH87sTJDa183KVX2E1teXS/xWYzVTG10K4wh898zBWcxEPerswX4RCmvkeRIkdmNEOFYaSjmjVzACB6A05ghYYOjEtG48kipZOfTS2UfpsUnhwn5frn4WmSs7OOciqk3zAuxZJMx2yqoQRCjnrUe0wxzok1yT1SooC2W3qOq4TV/mvpVIIMmI0Wyv2ZVfSY6Hka0t2hYsVNxFNSj7vyhD7XCSkkM4iCpUxzvuzQsBMc43RTzDTUnG9R9eRDbgCCaGTUkgbEClVHouSABJaPQLsnpK+4ahNykJxeLfROB8= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(366016)(1800799024)(376014)(7416014)(56012099006)(10067099003)(6133799003)(3023799007)(22082099003)(18002099003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?9el3whu7p6VvqL28IN48WIHOitR8LbXwllrMe8ee9C/8i4wiNYvheYAKfrZt?= =?us-ascii?Q?AlN08Dfyr2VI0AJFYzrAUc+nA6n49aypdhJzqpLvGrEWJGX/VF3v4Xxk+8o9?= =?us-ascii?Q?tlBOgsmSYOXXahNf2xLBHXwouEzIyGxvzIuPur3jqDW3y4JBKvsyMszML6AD?= =?us-ascii?Q?MUaDwFf6GwW+VicBmbhMUPl1mwCkAGgoCm+6OMJe5CqCpIWV7Yxs3urpw4wf?= =?us-ascii?Q?AumSHL9sjNZAkdwnsl3Z17OMjyxYeGuEt5m9aGVZ2p23plVRn2a7CHShDWIx?= =?us-ascii?Q?u3y2P5Unqec/A90DmaRkeM6ZoWi+/RD8ARCtdFEc/HIPQJzYiiskLdMLociT?= =?us-ascii?Q?ZYr8S6nh9vsqU7pOHlTwsGhAuuiXOvmqIvKudUDvw+d/pgVQtY/RakuX1L5l?= =?us-ascii?Q?lCBSBHkArMhXvVzBEGcJMqQesAda1r3L8X3d0A+qcf0otHYICIuYpuogmtLe?= =?us-ascii?Q?23+OyCXruDxlXF8WWIKbLxSfEX/D2sOW2WPn1GS69LBJCCBihvUriC+typoj?= =?us-ascii?Q?sZV93FNjxAQ3PR+7mEa0CH/HWpPJJs3sUzd+8wseJCEglocqSZwWb28Xukp3?= =?us-ascii?Q?CWnW6IhKmdGnmS091u+lPpRRigD8Yo+8Ee8UCIQYjYJUcj402FRaRwLiK8pU?= =?us-ascii?Q?VznF2ARbK+iX9ZD0fl31xNtcasm6pjCg1bWZfprBA8P5otr8IvtVPRlFEbzo?= =?us-ascii?Q?wCz07HECdGI//AuTxSJVhlvCikYnhJCoo396Y7zpuSFVKbkwh1hv67DGdY7W?= =?us-ascii?Q?RxAsaI1gbD5kuR6sovU5TtdIzW5DGliKFISFHdvacMh6HwTqZiB152WG3mzc?= =?us-ascii?Q?RGvNDExQsrWSbm1S2BeIpcpi76jSVQZUs32IcglhP5mrn7eYMBh/BExybBCj?= =?us-ascii?Q?ZVwT+iypNtidhiTr9rxjbv5VjjcKwDOxrhftGIoeeoG0Xln6o2S0xKdyI6LT?= =?us-ascii?Q?pV8t5TSVr5IndukWx+yIPi04L8vS5wDooURkiWBlKhtCn4D/c7XAphtkTlZb?= =?us-ascii?Q?t93kYp5SLYH5ZUaI1or2R+ZLHhdc3JUv89HA3ulBGWGHIRjDbSy1GfAWLOII?= =?us-ascii?Q?ZOAZ8wm77EWMvDPff4pvdsa1BF63xkCwnkku35Vmv3eVWNVTSqIMRKtT+7LB?= =?us-ascii?Q?d5rx/LZYGLflK0rqOKctVAHwyc9lPQRTR/goVNdsDVASsd/aP/1zdFVNrSvB?= =?us-ascii?Q?NpKiOfUI8eqV+1U+80qOkIrOivb7n/VIzMZrnFQiZLmRFQ8arpOUAQC5p32z?= =?us-ascii?Q?bPzeope+74gB3jp/+Z3pCtPNA2N75iEXlSj8DSZwLLHkUlu4Lo2OVpecQDB3?= =?us-ascii?Q?hRBzLSdJh7xa0dQPA7cdV2bl65lnojOmrQEcjv2kJD8fCMLmG9jaNQzlVRdK?= =?us-ascii?Q?NvRpxOn/gajmzgp2gHxtUOIoKqjNP4kIv7szjfN5pWpk05QgQzqNsNPYv02+?= =?us-ascii?Q?hqABU2KJ9P+RHXHaw076pDixY/x+fWj8ELqCMb9RNM9GSouJu1KZUQWRP1Xj?= =?us-ascii?Q?6j77OSuDI+qAuhP3YrfETc7dwl4Tswxf/cMi7/IEQm69RqbIoiALlHqWxx+1?= =?us-ascii?Q?d8TnVrCAy7qIqwdDtC4dyWHQ3KfLLIhZkwtVwpRsrSrCVyBQ93eHpbnp1GPp?= =?us-ascii?Q?sEFjMBSh0yCP1SwzM7bKCdC5tBBopSTVqWc7rEY4CTKxzJs2As7n/xPFKSfK?= =?us-ascii?Q?ruo5lHzo4JsAV2fB7aFJsuvQ9kp+euwRX3/qh51cUd7rtUrW6rFPRzBURwTz?= =?us-ascii?Q?wbgUxeWQbw=3D=3D?= X-OriginatorOrg: atomlin.com X-MS-Exchange-CrossTenant-Network-Message-Id: e76f9e3e-60b3-4271-4dd4-08def682e107 X-MS-Exchange-CrossTenant-AuthSource: CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 10 Aug 2026 01:58:31.6196 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: e6a32402-7d7b-4830-9a2b-76945bbbcb57 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: h1NSTUYXWTbYJUE0Ox0dvcwN7L0hX2JVMBiUTijSFERzOIFossgbnpmkHFDP9qZS0Jm3wxduTKQN0Npj6FpcIw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: CWLP123MB3891 In print_cfs_stats(), rq->leaf_cfs_rq_list is traversed using for_each_leaf_cfs_rq_safe(), which expands to list_for_each_entry_safe(). Although rq->leaf_cfs_rq_list is RCU-protected, list_for_each_entry_safe() is a non-RCU iteration macro. It dereferences pointer links without READ_ONCE() and pre-fetches the next pointer. When a writer concurrently adds a new cfs_rq to the list using list_add_rcu(), a reader traversing with list_for_each_entry_safe() lacks READ_ONCE() protection. Without READ_ONCE(), the compiler is free to re-fetch pointers or reorder instructions. As a result, the reader can observe a newly inserted cfs_rq's pointer before its internal fields are fully visible, leading to reading uninitialised data or dereferencing invalid pointers. Additionally, because print_cfs_rq() drops rq->lock during seq_file I/O, concurrent cfs_rq list removals and re-insertions can modify cfs_rq->next. If cfs_rq is re-inserted near the head of the list while rq->lock is dropped, lockless readers can jump backward in the list. Under sufficient load it could lead to unbounded list traversal inside the RCU read-side critical section and trigger an RCU stall. Fix this by introducing for_each_leaf_cfs_rq_rcu(), which expands to list_for_each_entry_rcu(). This uses READ_ONCE() during list traversal. Finally, capping print_cfs_stats() lockless list traversal with a hard iteration ceiling to guarantee loop termination and prevent RCU stalls under continuous list churn. Fixes: 0601267ca673 ("sched/fair: Rewrite list_add_leaf_cfs_rq()") Reported-by: sashiko-bot Signed-off-by: Aaron Tomlin --- kernel/sched/fair.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index d78467ec6ee1..eb03323332b0 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -412,6 +412,10 @@ static inline void assert_list_leaf_cfs_rq(struct rq *rq) list_for_each_entry_safe(cfs_rq, pos, &rq->leaf_cfs_rq_list, \ leaf_cfs_rq_list) +#define for_each_leaf_cfs_rq_rcu(rq, cfs_rq) \ + list_for_each_entry_rcu(cfs_rq, &(rq)->leaf_cfs_rq_list, \ + leaf_cfs_rq_list) + /* Do the two (enqueued) entities belong to the same group ? */ static inline struct cfs_rq * is_same_group(struct sched_entity *se, struct sched_entity *pse) @@ -497,6 +501,9 @@ static inline void assert_list_leaf_cfs_rq(struct rq *rq) #define for_each_leaf_cfs_rq_safe(rq, cfs_rq, pos) \ for (cfs_rq = &rq->cfs, pos = NULL; cfs_rq; cfs_rq = pos) +#define for_each_leaf_cfs_rq_rcu(rq, cfs_rq) \ + for (cfs_rq = &rq->cfs; cfs_rq; cfs_rq = NULL) + static inline struct sched_entity *parent_entity(struct sched_entity *se) { return NULL; @@ -15399,13 +15406,19 @@ DEFINE_SCHED_CLASS(fair) = { #endif }; +#define SCHED_DEBUG_MAX_ITER 1024 + void print_cfs_stats(struct seq_file *m, int cpu) { - struct cfs_rq *cfs_rq, *pos; + struct cfs_rq *cfs_rq; + int max_iter = SCHED_DEBUG_MAX_ITER; rcu_read_lock(); - for_each_leaf_cfs_rq_safe(cpu_rq(cpu), cfs_rq, pos) + for_each_leaf_cfs_rq_rcu(cpu_rq(cpu), cfs_rq) { + if (--max_iter < 0) + break; print_cfs_rq(m, cpu, cfs_rq); + } rcu_read_unlock(); } -- 2.55.0