From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from CWXP265CU008.outbound.protection.outlook.com (mail-ukwestazon11020133.outbound.protection.outlook.com [52.101.195.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 401FA48383C for ; Tue, 25 Aug 2026 14:14:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.195.133 ARC-Seal:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787667267; cv=fail; b=E/erBjsTY7OoWVOzpV56sDf06+i8Ah32K3J1PTVUCoTVYoDKHy++exMDX2vDn9687uhOkwj/hDAxJPoKgEDL98B7Zr1ucX44C7ECUobHAXFDAJ+pbASne2UunAFFhVWO4UFEfJ6TdtgZpb96I/suJqzBo37Y9O74VBfZcZFbSAo= ARC-Message-Signature:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787667267; c=relaxed/simple; bh=wiGXR6q2zWq4AcnibKRhSbwHra0/Lq1G5nPxxEhSXZg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: Content-Type:MIME-Version; b=OAVSiNv0wwow4xnuX7KClDl+VqAqiG0VUUZcsngAbG23uGmHb/fg9iDiyqkR2xUUPM6STZ3fwlIDEDRkvr3XxGnmUzl4RA0Q1kBjZODMZygtXZmkf3CrETp8e2vhhGZe/MvL0l6DWB+7lxFdjWUqDiyHiNqRt5YgtRD4oqJ6U64= ARC-Authentication-Results:i=2; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=atomlin.com; spf=pass smtp.mailfrom=atomlin.com; arc=fail smtp.client-ip=52.101.195.133 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=atomlin.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=atomlin.com ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=ExQmStRXmkep42pijBlrilxZ19ZNr4aGAmRTgG2XycAdrd0HAfknjFslinkWyLIPCiJtXK6hdmARroKWDCK2LV8nW7+R2NOdt4eEhM/7Tb/NLz4JRtNaSKfu2u9f7LYXL3x+ZM/L7M0yHeM5xxJ9S4mpRhShDXH2RU7vLq3xhdMu41magcba9lX6fIyZpwh9PvUAfWfsf57sJyT/BuBvkLVnDsU6HYBGIURCkeqMX1/yFQn5nPnrdanVeqcEvgf3SC+7gxM094ZSZGVvLTdOinHaw5ab96xxaiwKY1Wgysl9l4G+GhwlIEHdMpOL0r51zBwWg8BMNzGQZH13CFM3Cw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:MIME-Version; bh=GKF/J09G2GKf9X8pBqg3rP2feH1dN6DIG/dK3UbQ8d0=; b=OyjT8BYNdNGmGHtrnXN9hDWs86q64PRs23tTA0ENdHs5Uvlt1tKMiAvq+UekZY+F9Eh8KF/DUmf59c7tafGpa0daNhPvPUS8fI4iVmzEdyJYvAW90zxj1UNjzhB4x6LJH0EoKe2h9OAfHjzJ6rcFudqnPEjzPcio3+WO7zF61lIva5HrYgUaekVD1iC/fhEyLTftihXaPlxlo01AJexhZjvtBCGMlPhQiSNuNSAO70DraKWzdO/inzM4qGp1fnyLfPeQyjKZXsd4XYhQhe5YuoYT1xm8Y4s5UMgb8LH5/kLQqoR4QF6+hHZ6Gm4ZvR2ole41jtp1qUamKGR/8Q4x0w== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=atomlin.com; dmarc=pass action=none header.from=atomlin.com; dkim=pass header.d=atomlin.com; arc=none Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=atomlin.com; Received: from CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:183::5) by CWYP123MB8971.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:286::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.360.6; Tue, 25 Aug 2026 14:14:19 +0000 Received: from CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM ([fe80::cec4:77ab:262e:d230]) by CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM ([fe80::cec4:77ab:262e:d230%4]) with mapi id 15.21.0339.012; Tue, 25 Aug 2026 14:14:19 +0000 From: Aaron Tomlin To: mingo@redhat.com, peterz@infradead.org, juri.lelli@redhat.com, vincent.guittot@linaro.org Cc: dietmar.eggemann@arm.com, rostedt@goodmis.org, bsegall@google.com, mgorman@suse.de, vschneid@redhat.com, kprateek.nayak@amd.com, zhanxusheng1024@gmail.com, neelx@suse.com, atomlin@atomlin.com, chjohnst@mail.com, mproche@mail.com, sean@ashe.io, steve@abita.co, rishil1999@outlook.com, linux-kernel@vger.kernel.org Subject: [PATCH v5 3/6] sched/debug: Protect lockless rq->curr access in print_cpu() Date: Tue, 25 Aug 2026 10:14:10 -0400 Message-ID: <20260825141413.868997-4-atomlin@atomlin.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260825141413.868997-1-atomlin@atomlin.com> References: <20260825141413.868997-1-atomlin@atomlin.com> Content-Transfer-Encoding: 8bit Content-Type: text/plain X-ClientProxiedBy: LO4P123CA0491.GBRP123.PROD.OUTLOOK.COM (2603:10a6:600:1ab::10) To CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:183::5) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CWLP123MB6607:EE_|CWYP123MB8971:EE_ X-MS-Office365-Filtering-Correlation-Id: b5202807-0edb-4dd0-adf8-08df02b32730 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|7416014|376014|366016|1800799024|10067099003|22082099003|18002099003|56012099006; X-Microsoft-Antispam-Message-Info: Rp4vxtV6Us3zzAXCLkJrbn24u6+zMin/1Pt/hn9fJ+2AsXJ/WQKDJ81SjVOuXRbDm8TbrYog7WhXjZckF+7fCaur0bs448x+Y7mnaG/wHJNhTY4FohWcAnt5WMbAvU6q3eJOOphxz6EZnVWE+PhyZbnzVqqkxusd5nZwRifgOgsIe7jHDT0b1HhhqFqdojC3v8CL0MwWnMkUbTjjZf7SNDZBttsdEeDsSWTHr4tJ0wUfQLnl4RDLpaYT9VT/CoQhKkEPFXGjKwFZuCTsw5dpFTRqXM7iwwnV+DQVL5DCWc7JOjbsRIrC6DK7ts88m6G9AcCsGv9Z3kXLB05ZTAM13xtgywv0CCSz+uh0/O18U82u5phCWEKKzPbOgcFBYrf9NqqHJlwBu0UkMOQJc+xbVSaUDSX3N24n2DEYI2R1A0ZNP9tCG6U3mo7F7EcP4P+a7EanxQDHesuS5hTjd7fAI09DejrTLX8FtjxkQHI9li/8COGpPvGBbPDZVjCDod7VJ931bI1y76fNUyjJDg2YaEv36nDnkHLODH8aTA2W5RQ3WsslqeSAvSHAlVCb8X3yaVYwd+pQWoAkWHdywgpEPX4FubFLgWOtIf5qUlxQhwgYFhbqUFCTTR6JtgNUou3aeZGVXXHc0aJ2a2WgX5s9pznS9cAbpM6NBJSFU98dV8o= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(7416014)(376014)(366016)(1800799024)(10067099003)(22082099003)(18002099003)(56012099006);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?zaTqcjunN1NPnLf6t0Bc7zxU+0wdFR2+KCypVGOYJKHNVfWeSFSfFl4J5p95?= =?us-ascii?Q?ZpVgDCuw7hhCsiLvRa2cMLG0jdVdHBWkQhb57yoNV8DVjZ46VV+apqPV0tLu?= =?us-ascii?Q?nBOdZEn7vN6npjyctkSMXITdzyF4YPzwlvnLGqOhYcdN/U4fboTCPXhgwTYW?= =?us-ascii?Q?6PHIj8HMBd09euB/118i82wgDhcbucx/xyedd9tD6L5t4fFoGdUgSiS0fd4X?= =?us-ascii?Q?xDwJ5nOwkSonE0cDCDGU0VQ7BRpEMA1xTCS65ZCmNAHPwCqpb/+sdNvS7P/d?= =?us-ascii?Q?hJ0V1pT9MXl50teFF4GfXfJ6IoaHMWRkb55jUSZC/62C5n9PfIC+JFs/vyR8?= =?us-ascii?Q?YbK+7ABeYOj5gTd7+5MEkXCHBrM19YhK7u5YkEPyiDQcdTAxNdAfCdzdVaza?= =?us-ascii?Q?E8WgAIDy7hpwYTfi15ryKEKaVf/iTy/OESDSYjV8tntH0ZlQ0pbDSMZXOC2H?= =?us-ascii?Q?HLxxRoXhQf7xs3mSU3m8LKTUX/2hGk5V/R8K75pZ6aHC/WIh932+DZ3lhhLP?= =?us-ascii?Q?VLS0k8siA13D0Bect1AdH1QdGg2xIO/Cou4s3BDPiNe/8M9PFcsSzZakVUlr?= =?us-ascii?Q?AKUvER7ssq48naNv0b0B4DRaN0iLvQ02kJxMxX9DidyMkaPEcXmAF/v1rSfa?= =?us-ascii?Q?sriUmVLDlQidF9NQa9T0JYQP0DsnL9Ki/VoDnGoz7G+bEXeuqUVWS9CN0/Qq?= =?us-ascii?Q?cl5g2yj/KrD79FjMDEYlMldFU109yTwjo9PSggjdZL6p9PJQEd5YujLs3PWp?= =?us-ascii?Q?xsj5YcoFtcaspsqWUeHBFEXAO42qw6BAhuQMPyVJtgnUJanNcnvjWMJg+J/t?= =?us-ascii?Q?GVAiiSgur8sZLxUKbtN7zSGe8NF2CTlyDTDw07CwX8eQ1fe8k355qCb7v2jy?= =?us-ascii?Q?8kJ1L5pKo4GMXT/QCNUMAEhebVh6C2Fwn40WwnD2+jYy7VTHUF+lB6dcPjiB?= =?us-ascii?Q?zkj6qMaVCuwDbiA+BKLb7anPGjtOKrOaFwnEKoxELwBYQ7cnYFZ6hVe4DTRi?= =?us-ascii?Q?KFlZkc1SEvkU5GaLkNoFuCFSEeHGNhlqCP//5yq3Qob2lEE1v/aQMva2gnGC?= =?us-ascii?Q?5DHAhPqqMMpc3TJ0pbAFvbgZ+yk9+rb+gSB/pEldWSusJU1fGNzNry5a6yLd?= =?us-ascii?Q?zFY2d19lV+Djb3l4NZuyNuqYGkUq60JxhxmaylzUdXHPYm4JF3LElDH95eM3?= =?us-ascii?Q?B+A2VIVz9tjcbneyEUNnedVG5UAqRnk/sasm/MatH8Nao4eqW8niO6kX6Vff?= =?us-ascii?Q?vLmdArcDVln6bhKEhwL3HmmrzYXtcDX+9lcvCytSJltMDt9U1CyagEoVdzyv?= =?us-ascii?Q?LvVXTwcZ6sQE8ODZzHWP+lZVLTOw1jUnefP5Byam7189Sn2opQ21MgxjjfAb?= =?us-ascii?Q?ADpSOh1vpQ0Jo1t2UmCy7fqxVm6IN5TIB2KFSgPvqmHFOIOHZ43kOcCYPnPq?= =?us-ascii?Q?CyJkHCqxpgHYTPo5L343AGiLtLhwqbBGLJCYfItsjOxEQ7LpRb0dxnD7Bv53?= =?us-ascii?Q?u4eRVQivo8RQ2lSmz/i4ARjv0VorafZu+MJei+QgrT6Qo9VRV5ue2tVTuKif?= =?us-ascii?Q?/s910XZ58Xued3F5zZ18+G4F+Vu3flogU/KFfg70pHWvWoqWFgNBqcSI92CF?= =?us-ascii?Q?YcF096QLXWjJkP8qKAXxoKpOHmCRDbeX5d/Hngau5Em7BEToRkEuoo5jHw3w?= =?us-ascii?Q?b0RLf9WZJIy8Fi9Y+AMVO+da5D7UHhhnyJdSklcP+qnDmXV6?= X-OriginatorOrg: atomlin.com X-MS-Exchange-CrossTenant-Network-Message-Id: b5202807-0edb-4dd0-adf8-08df02b32730 X-MS-Exchange-CrossTenant-AuthSource: CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 25 Aug 2026 14:14:19.1579 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: e6a32402-7d7b-4830-9a2b-76945bbbcb57 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: tTRHMongfNcbpoLBMU8RouB+DFun2KdrfAkYfowSu1qvNsXB7tFXy5NozjgsNcgkVu1/slLQNYnDc+Cp+WfkJw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: CWYP123MB8971 In print_cpu(), rq->curr is dereferenced locklessly to print the current task's PID via task_pid_nr(rq->curr). While accessing /sys/kernel/debug/sched/debug is inherently best-effort only; rq->curr is indeed expected to change dynamically while print_cpu() is executing. However, if the task currently running on the CPU exits concurrently and its reference count drops to zero, put_task_struct() calls call_rcu() to schedule __put_task_struct_rcu_cb(). Because print_cpu() does not hold the RCU read lock while dereferencing rq->curr, an RCU grace period can complete concurrently and free the task structure via free_task(), creating a potential use-after-free race condition. Resolve this by reading rq->curr using rcu_dereference(rq->curr) inside an RCU read-side critical section. Holding the RCU read lock delays the invocation of __put_task_struct_rcu_cb() until after rcu_read_unlock(), ensuring that the struct task_struct memory remains valid while being accessed. Fixes: 02968ccf7b80 ("sched: add /proc/sched_debug file") Reported-by: sashiko-bot Signed-off-by: Aaron Tomlin --- kernel/sched/debug.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c index 632d5fe9e470..27e0840ba9be 100644 --- a/kernel/sched/debug.c +++ b/kernel/sched/debug.c @@ -1127,7 +1127,10 @@ do { \ P(nr_switches); P(nr_uninterruptible); PN(next_balance); - SEQ_printf(m, " .%-30s: %ld\n", "curr->pid", (long)(task_pid_nr(rq->curr))); + rcu_read_lock(); + SEQ_printf(m, " .%-30s: %ld\n", "curr->pid", + (long)(task_pid_nr(rcu_dereference(rq->curr)))); + rcu_read_unlock(); PN(clock); PN(clock_task); #undef P -- 2.55.0