From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from CWXP265CU008.outbound.protection.outlook.com (mail-ukwestazon11020133.outbound.protection.outlook.com [52.101.195.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id ECB0848165C for ; Tue, 25 Aug 2026 14:14:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.195.133 ARC-Seal:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787667269; cv=fail; b=DO0ilP0CF9a73kwKKkWg3di6jQJ3dVR+dULVO4Mjrw7HKXwmO0w3uMZ2qmixtXolbn6nZmHR/7Ti/C1hrxqejkQlQov16aLH6fwDsV02k9lvK428BYZs4ekKjq1dd+DgRdlrulJTLULv2A+M96/x8am5ye5O7caRZ05XOeDxTag= ARC-Message-Signature:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787667269; c=relaxed/simple; bh=3lhMzHas/uh4/DrY0pO9kuckfK2pC3KlOv/G7+zWHcw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: Content-Type:MIME-Version; b=YlxSid0TMi7K0y6i/Kb0ZhcZzd6rqCucy1SOl8njxvrfhU6KOheqncUvGzADBmbMtYdaGrhqg90jIp+vbitt8DWI0q2ERi8aCyvPerZencjoEcsBrEKNNxFZzjQkPt5W7iaOzRB2SKEzz3kqYSPDrL+MSs7N1pTGqSWQfgqa8PQ= ARC-Authentication-Results:i=2; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=atomlin.com; spf=pass smtp.mailfrom=atomlin.com; arc=fail smtp.client-ip=52.101.195.133 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=atomlin.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=atomlin.com ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=E4XcTJV182zVbWA7O+5SwpoH+c9K5tnh7uz3/oEzALdUwPbS+neMIhKE0rIwlfhRkKWueClhdA6AdVEGLP0AzWAhXLG0vxus7zJLaH26YhGf33kisF519aQ2uAzXmvxaffpH8a78ocpr3B36vD5ngT9KtLZ990w8rCGzUF7JoHgHLMlNLUFzSAuUoC8YVVZ63GQpozEJprB+daLkVMI7mzbbWj7D1bNlR0PBGVw3sigm0acNlea8Opkoi/0ZBLQ9VujHv+fNPvCG+Lgijo1fI3Cko6nvRF+y9wKWahnA6GBts+SnlsaIYP+/3+3EkLoHI+wUuvIx5qs4sb4ERFCUOg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:MIME-Version; bh=yhNziI3nbRiOwj+s+zdt0uNKjwfvhmYMdUwsNiOUiYE=; b=Rk3JRP5OpsRp/bBDkGW2jsXx7rIIJd+ygFhyKmEJNFHuls/ECZVuCDMJAZ+fGlT6zo4q9PMN9yCqBVUbX6PkOEOZE1eG8etg7vIMARCcQtHjGEG1Ntg5o5ekW5vXorlsy2lhbMxD0U3IB3WigWnAKxfWyn4uWGo2YfzvO7B1kLC6zBnaQhwJ8m3QBfwGQ9WOJ9iciGaBXQyd9p2fC6r+3bebHfvtA9Y6SMmLGjQMt5WfyANTR7cy3pDqN8/XzXUoNbmYqNniZLnvepIg/sK099H84WBldnVqAU5vAk+cmjIVVYgNHVmO6D4FecP4Oj1Vu1xql+KiubBOW4e571HEDw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=atomlin.com; dmarc=pass action=none header.from=atomlin.com; dkim=pass header.d=atomlin.com; arc=none Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=atomlin.com; Received: from CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:183::5) by CWYP123MB8971.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:286::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.360.6; Tue, 25 Aug 2026 14:14:20 +0000 Received: from CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM ([fe80::cec4:77ab:262e:d230]) by CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM ([fe80::cec4:77ab:262e:d230%4]) with mapi id 15.21.0339.012; Tue, 25 Aug 2026 14:14:20 +0000 From: Aaron Tomlin To: mingo@redhat.com, peterz@infradead.org, juri.lelli@redhat.com, vincent.guittot@linaro.org Cc: dietmar.eggemann@arm.com, rostedt@goodmis.org, bsegall@google.com, mgorman@suse.de, vschneid@redhat.com, kprateek.nayak@amd.com, zhanxusheng1024@gmail.com, neelx@suse.com, atomlin@atomlin.com, chjohnst@mail.com, mproche@mail.com, sean@ashe.io, steve@abita.co, rishil1999@outlook.com, linux-kernel@vger.kernel.org Subject: [PATCH v5 4/6] sched/debug: Protect p->mm access in sched_show_numa() Date: Tue, 25 Aug 2026 10:14:11 -0400 Message-ID: <20260825141413.868997-5-atomlin@atomlin.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260825141413.868997-1-atomlin@atomlin.com> References: <20260825141413.868997-1-atomlin@atomlin.com> Content-Transfer-Encoding: 8bit Content-Type: text/plain X-ClientProxiedBy: LO4P265CA0199.GBRP265.PROD.OUTLOOK.COM (2603:10a6:600:318::16) To CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:183::5) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CWLP123MB6607:EE_|CWYP123MB8971:EE_ X-MS-Office365-Filtering-Correlation-Id: d8621cee-5afd-439d-70d1-08df02b3282a X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|7416014|376014|366016|1800799024|10067099003|22082099003|18002099003|56012099006; X-Microsoft-Antispam-Message-Info: VR7CZ1jgt+Qcan7K+fWIfJWDtLeWHXQpBd1x+QmJNsZynWJH61kj9vihm8FQzAwec54C3lhckPLiFKrxkfNRUfTS4Btf5GuEW4QHYJqWVXcXw2CQIs4hRTZMjTscVZmGAQwgyjwAf3If0mLtaAmOTc0mSlY2i0fSdKBIdoEx0kc1A7fJqhUBlZXSYRSuXW+VD6ECzIjle6/d5EaK0NACgurypSV7i/Fze725fgY7yg1/ppnnj9/JVAbS/jpPcsVjAoOun5VE7SObYT/MV6fl0Rs4LeOHbenGOTkLnB2SutlEJhwaxb6OSg97vC9Ik4d4ZOjq3Eqer0cOO4Q+U9ixTmTmizNiCP5gcZSF2q9+TI0BzYIVgA3hfek+OTnwpuJD8kdPpIRzYxdhAWqXZueKUSZTVT5cXOX5apXOBw0WToEaiBieHBmpPp3PpDOBtRswLMlOc7n0Np4DINohxdB61NKcoCeFBW76fIx6O4URGwfhUKR1h13h91ko6gS/YfFsiTYf5m7JKtJaJ+jRApR5LYgIFrP4fvMURnFdGLHrUCSfywcBIW6eOABSAmc8OWWIZJ98Cw+jJY9EIS2OtG6lDpPVDVIgCkd4DXcDcwDlm/vJmM0pyM4toqkighkud6DgPTuRe3JXK7+k2uMxBglhQVse891uagrLppBwOtT8hZA= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(7416014)(376014)(366016)(1800799024)(10067099003)(22082099003)(18002099003)(56012099006);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?l1/MejymtWyAlCp2fU6g0OLWCMb81yxTUqBZqzVU+erYRbZRWfNAAV656CJT?= =?us-ascii?Q?EZ5tn2KBtcuArdC/Z4Dmdx08C+qRqrVWJhz6neyxUOH2oYxL0sU50f1T/z7f?= =?us-ascii?Q?1Fvflt870OlZOK5y/OEfkZAmOc0c8u3CheBb1n8XrTIuRCG8Erl1+lq6fuF3?= =?us-ascii?Q?iW1PoruxwGN0wLCop/+8BqjgHVTI7HDF8PUOAWNX3M5dzOUEqEnTSKfPMPM3?= =?us-ascii?Q?8f86K4jGyyxFkHDb8H0iljx/TEGyAw1vl7US7YeO34XY8bT4g6JN0BwLzD4p?= =?us-ascii?Q?whqhHJIahep45b/PRZ8cDccpAln90aFIrkr/O7KCuCn4V0kz/5Wn5AceYiM4?= =?us-ascii?Q?9BPqDALq/FMjM33eh9gGshJXUmpAexsMWLxLUdr28RxV5NdvjznIt0Vjqt+y?= =?us-ascii?Q?t+0eIlTJbZBbd7XrofHcLfimC5U2aiMTKxmtGxibGJXPuVB3pnREUxYTlsoM?= =?us-ascii?Q?laCMxQ/5TPADPY8hmtn9ToOy4LfaCiAsrOdKTEHJGV/UO/ZOMtBovZHs0pei?= =?us-ascii?Q?7tvHdaHj5zWCHiHEMsh+/yQiY+4Pab3AA9JdXLVdOLU+v3/l8nykT7SgeLRb?= =?us-ascii?Q?e/p4fdnBqvRKX9bJcktZurApGMYEOWL7HL1wUxNBGRhN7E6zRZRcst0R3fG0?= =?us-ascii?Q?hOAiL8ZLzvURAzFdBsp+O9lKS9LkkEBHFN0PUs9pUBgACkl3XUMPxDDGUPvI?= =?us-ascii?Q?wwqTVIe0kniEYN0eLqjtqU6ZzyMjJvNifutatU5+1ofXzPWneZYcthJtQ2rc?= =?us-ascii?Q?YyTZ9crEJURHciYIi1uROoHPlX3pKe0M/J09MuA6ACezjniI1CcIfJb1nP++?= =?us-ascii?Q?PW8ak0yyfrXiwAbXzPBzvR6amflEubJYRPbj1RX9GBKzIS6v9+S/y2fbTMNv?= =?us-ascii?Q?dX+BNPy0snvgw1KU1HblRcG4UUjPJIT35x9LlxXMvCWYRlZAEli3JORiufEq?= =?us-ascii?Q?COwYHp+VgdzunbhPQy6Eqe+F0plL/PdLePnAg//aq/0I9hY6tS0YZUsrpL4u?= =?us-ascii?Q?4y9bxXbVk0HpAs+qUqeX6RAoxYdNQyctGGFS74lsOvvDAtBM74ecUEZRMU6M?= =?us-ascii?Q?19mBOzQlGgIv3YLmxdnHiXzYAC3WiUisKGLiRKRNB8B3HocGkf0K2t85fXWF?= =?us-ascii?Q?s/WuykuFK4VNa8h+GEFK8nIo7OwQw/Gf4EfLd8sCsoVsqPnywI3f6rXaUWKc?= =?us-ascii?Q?XsBujEzC1K9BzbCgzdC6faOfjXC7yVlSG+AiORtj8TGNRpYeF5CC2ababclu?= =?us-ascii?Q?FC+AUVNOvPf06hrNaQMqpxapjC+PXUyAGuuSvrUsDxo5WWqXQmMEIlNwwolh?= =?us-ascii?Q?IWU/XpOdymNtD7fdf24Nq4SJha61dk6hfiiFU/2iwSt4zyvdRwQJkvbOH22S?= =?us-ascii?Q?ZAhc8sWiglA1pULSJGL973Ubdefq1drhvp/PL7ounVishXf+JjYiEu1BaM9h?= =?us-ascii?Q?O81zVdIfScb506t2i/uWcgaaWH/WZvSJurDBBtVFs4Dx1eb6fXN7/vAimoVG?= =?us-ascii?Q?ycpyUbVnnrpMZI+K+FJFmnpxiA6kDGb/xGOFeCywJf6LhT4G7DOy7xW9twnh?= =?us-ascii?Q?qO4NNt9qJXgh/+HVEK/WrQ5mzC64zYf0AlnFSOimrsppgtXxCFTMF1glNf2H?= =?us-ascii?Q?pidxDxFYh4AbQ7gNqW6fvWO7/XLzLUR5Hc259M2r2WNCS0hs3RIQQ9dOKRID?= =?us-ascii?Q?DNJ+paOLlCGhBDix/JjEzt1f4lYdfd6ElfQ8vtXOas8LQQDb?= X-OriginatorOrg: atomlin.com X-MS-Exchange-CrossTenant-Network-Message-Id: d8621cee-5afd-439d-70d1-08df02b3282a X-MS-Exchange-CrossTenant-AuthSource: CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 25 Aug 2026 14:14:20.7955 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: e6a32402-7d7b-4830-9a2b-76945bbbcb57 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: rLPHDjOvTJgP1V7SzZJnbo61BGCVZjaW1JYrxp3R7BMxCvKELo/8Ur4JDCBun2zExCoTfCYGx0f6Zz3nnqyFzQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: CWYP123MB8971 In sched_show_numa(), p->mm is checked locklessly and then passed to the P(mm->numa_scan_seq) macro. This presents both a time-of-change to time-of-use race and a potential use-after-free vulnerability. If a task exits concurrently via exit_mm(p), another CPU can set p->mm to NULL and call mmput(mm) to free the struct mm_struct. Dereferencing mm->numa_scan_seq without holding task_lock(p) can access freed memory if mmput() runs immediately after the check. Fix this by wrapping the p->mm check and macro dereference in task_lock(p) and task_unlock(p). In exit_mm(), current->mm is set to NULL under task_lock(p) before mmput() is called, guaranteeing that p->mm cannot be set to NULL or freed while task_lock(p) is held. Fixes: b32e86b4301e ("sched/numa: Add debugging") Reported-by: sashiko-bot Signed-off-by: Aaron Tomlin --- kernel/sched/debug.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c index 27e0840ba9be..c05ba4d8b169 100644 --- a/kernel/sched/debug.c +++ b/kernel/sched/debug.c @@ -1312,8 +1312,10 @@ void print_numa_stats(struct seq_file *m, int node, unsigned long tsf, static void sched_show_numa(struct task_struct *p, struct seq_file *m) { #ifdef CONFIG_NUMA_BALANCING + task_lock(p); if (p->mm) P(mm->numa_scan_seq); + task_unlock(p); P(numa_pages_migrated); P(numa_preferred_nid); -- 2.55.0