From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from CWXP265CU008.outbound.protection.outlook.com (mail-ukwestazon11020133.outbound.protection.outlook.com [52.101.195.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DB41D481FCE for ; Tue, 25 Aug 2026 14:14:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.195.133 ARC-Seal:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787667265; cv=fail; b=Adqi1uh7cKZNw+k8R8HOUQeXrKsh5sBoNzYc0zjNOUeOqvV6kcU78NVeoMhcjQ8GX1jIZ74kro1q6Ge7CmDe1Pt6AIrafdHwwNivodf0e7PBRkrnj2tWarlpuj7FAPwaj3V3+cfjGoNE74dGToYHQ9ZR9zZr2rr3ehni8Zs/b30= ARC-Message-Signature:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787667265; c=relaxed/simple; bh=YOXT5xhmbHbCiG1dJsjKr8ALDa9U1IHzsmyHP7vVVio=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: Content-Type:MIME-Version; b=JfsA6msdzUc1k1zID6DDqGGOK63qgT4gUcTPxgsqtujWX/OZRQNAvy3XI5hkaJt97YgqcesJzWmJA1uA3S+Bgbyf64q6W9hXgFQO/4atcPJX02DNBgAXVpLwU/wSafmPu8HJgsfkSo99j4ePNOzPgReiJASVWMoEQCjr+uhJ7KU= ARC-Authentication-Results:i=2; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=atomlin.com; spf=pass smtp.mailfrom=atomlin.com; arc=fail smtp.client-ip=52.101.195.133 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=atomlin.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=atomlin.com ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=O37NIVGQfJzhlhnL6SavN0ZtsFISKRAiCwpQ7nbO1yhp1xgXwQ/HD//ZgKgiT+yM8mOfx5Yilkyfnu0hY7jB7pZni9oJwKYjmOdl3VKDcHG1mHMKIT1XQrlvdwPkC7Nwooyp3N2VJvJ4Ankkr7xXgiaTl7uJ4sAtYkruNRD7TOjVVVdEK/NSVlzThMEAd07MOQbluUJC442HAw0nTSrzg7W6qXBScuuRzfFoKSG0RXB99FQq1jmhLy5z8mswQlDQdiPG0LrYPPB/6o20w6ReYz71bh5ASE2YfIg8v8xkS5stxFf2I15Kpb8d1fB+Jju6icFX440NoXQUZy/zS0QY/Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:MIME-Version; bh=dAB+NFGSr/yzNokZfAlX8DQyn0cs8RAEgEigIJeSk9k=; b=WWaBWpadAn3MG4X/9Mt/l4t2ZdI1VH/+GxRXpeeFxC0j67gOLPOyeFKNhBWTuKjtZ/wC/WRxj48flgm/77UA+8ROgabjPAXq8fl3M2QZDONaLetHSvZ0Krpc71spJfks6MkXNuLHH3u9vDmipiyaXna/PnIUT0lTIYgCZ14BZzGhVLFJkQwK8/VtZlSpb5fKQCA4m1VEQaWitnMzsESSnURnjfiYWTfR7zv9qba5FaUhcaUFp6npMXgl1PloNUjGW58oHB/mTnJBhZRF047mTmy+QY7lbqv68WWUkZ+LNKr+Mp9QnMlXNZcU8TwOpnajGolSZ1062CGUCWobtLrP4g== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=atomlin.com; dmarc=pass action=none header.from=atomlin.com; dkim=pass header.d=atomlin.com; arc=none Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=atomlin.com; Received: from CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:183::5) by CWYP123MB8971.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:286::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.360.6; Tue, 25 Aug 2026 14:14:17 +0000 Received: from CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM ([fe80::cec4:77ab:262e:d230]) by CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM ([fe80::cec4:77ab:262e:d230%4]) with mapi id 15.21.0339.012; Tue, 25 Aug 2026 14:14:17 +0000 From: Aaron Tomlin To: mingo@redhat.com, peterz@infradead.org, juri.lelli@redhat.com, vincent.guittot@linaro.org Cc: dietmar.eggemann@arm.com, rostedt@goodmis.org, bsegall@google.com, mgorman@suse.de, vschneid@redhat.com, kprateek.nayak@amd.com, zhanxusheng1024@gmail.com, neelx@suse.com, atomlin@atomlin.com, chjohnst@mail.com, mproche@mail.com, sean@ashe.io, steve@abita.co, rishil1999@outlook.com, linux-kernel@vger.kernel.org Subject: [PATCH v5 2/6] sched/debug: Protect lockless rq->rd access in print_dl_rq() Date: Tue, 25 Aug 2026 10:14:09 -0400 Message-ID: <20260825141413.868997-3-atomlin@atomlin.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260825141413.868997-1-atomlin@atomlin.com> References: <20260825141413.868997-1-atomlin@atomlin.com> Content-Transfer-Encoding: 8bit Content-Type: text/plain X-ClientProxiedBy: LO4P123CA0428.GBRP123.PROD.OUTLOOK.COM (2603:10a6:600:18b::19) To CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:183::5) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CWLP123MB6607:EE_|CWYP123MB8971:EE_ X-MS-Office365-Filtering-Correlation-Id: 7127c7f4-d544-4998-af06-08df02b3264a X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|7416014|376014|366016|1800799024|10067099003|6133799003|22082099003|18002099003|56012099006; X-Microsoft-Antispam-Message-Info: 1l6F+ixZ+X5Dbu6A67k9jg2wvDmmw9qGNzzLexIq9zcdkBScgf7zzBstdo/AtRrtlD/grg1MXKQlvZbNVGEmB92xFWCbCURoP/ezS4ix36X0j6VqMkYHwia3PRVWtqN3DYdKDaV6ELgyjBLSEsSxI1RgkL3JwUt7u/pxVrb8RapyWeMBUSoGdx+S5/I7B16LB2QpomwL7sqvPEubhbRgw2TvJCnx8TnDLbeEOqv9taWrTmV3rIRMdiOzpGsiKkn/Aq6kM6EDfZKCTv/mOp/bDiK+HLNxc1G68kvdkYerHBkt9tjfI0qu5EB4A6zIc92k8hzmtZSsNPSG7cB4NB9DRJuhsYJkQ1Ta50QGDWqqQHcrhVxwrnUTHNUTxWCY0LOPDNUGrZb9EYguFC68117LAxEzQg7jpc3oBGBbjZUsBMhSFduODKXuNSzZJ43y4Hfn649sTbol99Q64jBTv8mswENHcofxB/4RSqMTInhE8PUUCFQ8TRio7CV2l/6Vp5LRjnCcAXYKiqCx7XGiIn1eNPd2G0SwcVA7vAm8uI5y5tnuttjPxzeq1j4pOiHCo827DjsZhI0ifMXTsLQSY4XkewyPw1zPCuuSoOSm1Jcd4ZFfu6lXhvshaWcCWJljJHLTCsPBgtTa4Vypw3nmqTbpMVPDwpCTj3SzVeci3mxai8o= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(7416014)(376014)(366016)(1800799024)(10067099003)(6133799003)(22082099003)(18002099003)(56012099006);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?4ZcJF7CVKFtRByoy8SVofYe426OPS9JV/N3J8SZeAEmJzv0w/+FdItEA05pO?= =?us-ascii?Q?U3Mn5XY1xK8xG6ykyfNcsq0jh2fXjFz1sij1nNUTTd26yjbGAq4YV8WNu9+W?= =?us-ascii?Q?MptKQGafiB2HFOj5TzB2wWFyQi9rk0XYM60CRnLKx6Ut8tZOv12Q5na18BrS?= =?us-ascii?Q?r4OBlSZUldzJ8GuTD75cR/4UZB1/X4cT5W9f054J9qepQ0RBu55GzZwN2cUr?= =?us-ascii?Q?0mdoMNUdZsmkOHqrSWZWDOpGDqFJblJMaJicvmMG+oeCSFc5nTrroAV6t6GG?= =?us-ascii?Q?mburZPFBTfOFa/B8UPlpPx1XJXEOJJp6kMket3DTzjvrM6+MEoL+d55am0dd?= =?us-ascii?Q?1Z4FbZy2cVOrE34MuK9sETaRU8anY1aHwbPp1zZ+K5Um4evKP8hp9sbTvfXJ?= =?us-ascii?Q?GDuV//3qW41kJHFx2ey5eGDccPuLJ2RQcxYcZdCtonsapvVhKSCkGnBc9JtI?= =?us-ascii?Q?LQJbz78s482G+b8PbkaeuYx/kwO/eEKurLZwGCsolTYRXkhXcu/CTblny1jy?= =?us-ascii?Q?6TDiFK60DeE+TOzZ0ONaIk9r1PPHD0/rmTK3DbU0os12jAnh8H2CQkeJhKFF?= =?us-ascii?Q?1w+S6gkUgyX6FcLkrquJY9PM6I/94TJsdRbmcd7ThjJJcptVU2JtsHPAwelV?= =?us-ascii?Q?F8NuYXrNhC7+U1HEZHKWngB1ckmNpwJN5Now17xSx1VfXS7RIAn48qqzc7i/?= =?us-ascii?Q?7Nw+oq0bFausvNJo8NCtuL6uKVYzEX0xBfkPy2GFPb4wWSL7zU40zifJOLSK?= =?us-ascii?Q?i4TXxeI7nqrfp6z3M6LibcpoUcH0yzPrsARI05jYB/1fjMrTGFGyr4wPYIhP?= =?us-ascii?Q?x349O6pjThfxzzCAfm68SRGjkWH8eVgR9DB4RE4BbTxSGhGGnQZ7xAZkjPPR?= =?us-ascii?Q?eCzaFH+HDxEb26QLfXHsTRMceq5aQQqYe9duuWflXjDybrmaQGdEagsmngTB?= =?us-ascii?Q?RkLtZK72YvXlBresUMZY9Qft90YHVZybiM+woqQkCiJL5lQSbfJNdCvVr8Er?= =?us-ascii?Q?nP/bg9nnkExmtUu6tfGCTJmIK/hfuwm2rOQSiQhzef6qJLTa1tJQfaf1Z3Fc?= =?us-ascii?Q?1VjupJrD47YGMO0e1C8AIn2LkV8uHR+SY8fe+yQYhVcvvBE5bfJLyqa+81u2?= =?us-ascii?Q?sMK3jW9ChrY/MpZCe6DVUuQ4jVzZm+QWeo41xoaYM4eWR2/0idiPZbsgMPcJ?= =?us-ascii?Q?GQjc7iyIGLB3Lux5sDmpkC8EvYyoKusIAkzawUdKddq9SLTgGW5TfViWO7N+?= =?us-ascii?Q?gxTmZ0D9F1SHWcu3tSfAiiXT4BswrqmSO+LjouhrNFv9HSFzrxLX7n9+tIAH?= =?us-ascii?Q?NBfOxo7wUfwIEzK3vT07qe75hqj8iSRonxyxW+0iQ4pU4+DyU6DYDDBZyto9?= =?us-ascii?Q?D0j4B+se/r43SV/SjFEp9hC2/nOl7LtrhmXZKpDzYyJIJAhtabr3dtyVAa+p?= =?us-ascii?Q?3iKBnCllQ1aWL5kzRf7aobngeyIXaTi+p0+H3FTSsBZTHYFRfh4RAcKy1zyj?= =?us-ascii?Q?LZ1wRIsDRmT1UQpxQ1ULWeXmZKbJdTOwgR9XMY0b1NX37WMktwl6Fi6euUOJ?= =?us-ascii?Q?2vV4n6yx3hM/6pwl3bKXs5Y7ajksz44HFS7bJ1EtTpYb1U1HjZM9ri2lpnH+?= =?us-ascii?Q?YZwrlTn1DfuKfeDrgI9NHG8UeLITtWyONaTIAHhIVyAETY2bISeFR4F9f1Co?= =?us-ascii?Q?MfWHi/kn7WCE7zsHxlohPXGfRddg6jS6kWikp0iNK4ubcQb9?= X-OriginatorOrg: atomlin.com X-MS-Exchange-CrossTenant-Network-Message-Id: 7127c7f4-d544-4998-af06-08df02b3264a X-MS-Exchange-CrossTenant-AuthSource: CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 25 Aug 2026 14:14:17.6021 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: e6a32402-7d7b-4830-9a2b-76945bbbcb57 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: qpOcuf/vToodQz9cCVWe11hFunNCTLTGHPdLIQHLq+nLZsPy3+wGyCLa4oAwcZpF0KHTylSw5xmSUrmXKMZ/9g== X-MS-Exchange-Transport-CrossTenantHeadersStamped: CWYP123MB8971 In print_dl_rq(), cpu_rq(cpu)->rd is dereferenced locklessly to display deadline bandwidth statistics. During CPU hot-unplug or cgroup cpuset repartitioning events, partition_sched_domains() calls cpu_attach_domain(), which executes rq_attach_root() to detach the CPU from its root_domain. When the reference count of the detached root_domain drops to zero, rq_attach_root() calls call_rcu(&old_rd->rcu, free_rootdomain) to schedule memory teardown after an RCU grace period. However, rq_attach_root() previously updated rq->rd using a plain C store without an RCU publication barrier (i.e., rcu_assign_pointer()). Without a release memory barrier on the writer side, CPU or compiler reordering could allow the new rq->rd pointer store to become visible to other CPUs before the initialization writes to rd->dl_bw are committed. Furthermore, because print_dl_rq() did not hold an RCU read lock while dereferencing cpu_rq(cpu)->rd, an RCU grace period could elapse concurrently while debugfs is reading the file, allowing free_rootdomain() to execute kfree(old_rd) and causing a use-after-free race condition when print_dl_rq() reads dl_bw->bw. Resolve this by using rcu_assign_pointer(rq->rd, rd) in rq_attach_root() to guarantee a release memory barrier when publishing a root_domain. Finally, fetch rq->rd using guard(rcu)() and rcu_dereference() in print_dl_rq(). Fixes: 02968ccf7b80 ("sched: add /proc/sched_debug file") Reported-by: sashiko-bot Signed-off-by: Aaron Tomlin --- kernel/sched/debug.c | 3 ++- kernel/sched/topology.c | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c index 40584b27ea0c..632d5fe9e470 100644 --- a/kernel/sched/debug.c +++ b/kernel/sched/debug.c @@ -1089,7 +1089,8 @@ void print_dl_rq(struct seq_file *m, int cpu, struct dl_rq *dl_rq) SEQ_printf(m, " .%-30s: %lu\n", #x, (unsigned long)(dl_rq->x)) PU(dl_nr_running); - dl_bw = &cpu_rq(cpu)->rd->dl_bw; + guard(rcu)(); + dl_bw = &rcu_dereference(cpu_rq(cpu)->rd)->dl_bw; SEQ_printf(m, " .%-30s: %lld\n", "dl_bw->bw", dl_bw->bw); SEQ_printf(m, " .%-30s: %lld\n", "dl_bw->total_bw", dl_bw->total_bw); diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c index 622e2e01974c..b411cc00029c 100644 --- a/kernel/sched/topology.c +++ b/kernel/sched/topology.c @@ -496,7 +496,7 @@ void rq_attach_root(struct rq *rq, struct root_domain *rd) } atomic_inc(&rd->refcount); - rq->rd = rd; + rcu_assign_pointer(rq->rd, rd); cpumask_set_cpu(rq->cpu, rd->span); if (cpumask_test_cpu(rq->cpu, cpu_active_mask)) -- 2.55.0