From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from CWXP265CU008.outbound.protection.outlook.com (mail-ukwestazon11020115.outbound.protection.outlook.com [52.101.195.115]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 44C373AE1BD for ; Tue, 25 Aug 2026 18:46:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.195.115 ARC-Seal:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787683612; cv=fail; b=CHRrqiSKr33/NMHL8ArapFx0jomTiguQmrqi3Edh1RD2iu56aqnJA3MIJ2kDoYgLZ582X4CkkzEgcsVgKRsBbX23UrMbbLyBmTmb2LDclK7a2R83UdiIWeOYBoN5Fs04532O7kyCbifGiye8Lv72GsFn3tCQLE7VuAY5+S1OuMI= ARC-Message-Signature:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787683612; c=relaxed/simple; bh=oCpfRzeW3vnLiZYXl9KF4nlo4FqZ8G5BMJbONYFGHqk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: Content-Type:MIME-Version; b=cnEwBmsjwx0XZqIMxx9tL+guiyU/aSHYR+S0BkDjCVnsvGTl0euYyBgAmXeKBSQ9hE2N2Mu+bAyEThlm8YQFTW1WSIXMXnr+xIQEvoglM0y8WQysjhnxNp19sP00IfTtWAsN+wenJM9LrYnEhRkcEzNWPOXxmSMh15w0CCncWFI= ARC-Authentication-Results:i=2; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=atomlin.com; spf=pass smtp.mailfrom=atomlin.com; arc=fail smtp.client-ip=52.101.195.115 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=atomlin.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=atomlin.com ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=zPE6ifKzOqbq9nOX3OprpfqLYDkLGPnblFvq9RjJQI/Ov3bmZB4g+XQ/f9LpplH2FKeduGiD3BQSJbJDsa9PGfZREK3u7OM0RQqNLwEZR/8yLiF7rDTr6F9RcffzmKjq2YRVZyikj4mZM0H+nRET4g1gHc0V6xHMPF4kORly+84hnw316eLzDaTK8NqjmIKjnxX2x5Nr1YJp/4ndyBhUTy/B0cI736j1e1PEJjOnkNkzjAILaCiET7M+sdRk+WsYCsSeGRonvfV+RlnwHndxVjw+Glxbj/2+yBP5ad194yeXEFm7A3o1dyPQLVc7b1AzSLnFOvmgVDrEl25c9xYJ4A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:MIME-Version; bh=dB/5EqRnB7B53vImUMVvge0SKpUE/VZxSsGjvVV0jHg=; b=voFfOTmzah09Ix28pSKQAO+8b2OWnQRb1F/Kcc60hM4B2M/Tzr/s7KGyVMiiPQclwL+gRZuKnLkNHPmqKmxmowSolCl2SDXUa0NveCySt+qDSdgUtFmokvkpqwIN8+N6+fDBB/+9IbQSSXb0g9UtSkmCp5mE1ubNqLMz6Dlg3ecW1QFIfoRhscil/Pif8Jqr3jTqYDznST35Kc8QP8zWJqnxOhTVG+T3pFftcWkNheC62JuzasXbt4pUBVozOM4qYSdEH9A8f0ZLX3Os6NhYwlAtqkfJsN11vcGp9gbgbvwtPdaYP+TAJdp07IkGPSj8XolOtDRYd6M8OE3Ocu/VQA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=atomlin.com; dmarc=pass action=none header.from=atomlin.com; dkim=pass header.d=atomlin.com; arc=none Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=atomlin.com; Received: from LO6P123MB6616.GBRP123.PROD.OUTLOOK.COM (2603:10a6:600:2b2::11) by LO7P123MB7501.GBRP123.PROD.OUTLOOK.COM (2603:10a6:600:40c::8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.360.8; Tue, 25 Aug 2026 18:46:45 +0000 Received: from LO6P123MB6616.GBRP123.PROD.OUTLOOK.COM ([fe80::3975:c5e7:bc1a:f383]) by LO6P123MB6616.GBRP123.PROD.OUTLOOK.COM ([fe80::3975:c5e7:bc1a:f383%4]) with mapi id 15.21.0360.005; Tue, 25 Aug 2026 18:46:45 +0000 From: Aaron Tomlin To: mingo@redhat.com, peterz@infradead.org, juri.lelli@redhat.com, vincent.guittot@linaro.org Cc: dietmar.eggemann@arm.com, rostedt@goodmis.org, bsegall@google.com, mgorman@suse.de, vschneid@redhat.com, kprateek.nayak@amd.com, zhanxusheng1024@gmail.com, neelx@suse.com, atomlin@atomlin.com, chjohnst@mail.com, mproche@mail.com, sean@ashe.io, steve@abita.co, rishil1999@outlook.com, linux-kernel@vger.kernel.org Subject: [PATCH v6 3/6] sched/debug: Protect lockless rq->curr access in print_cpu() Date: Tue, 25 Aug 2026 14:46:34 -0400 Message-ID: <20260825184637.888364-4-atomlin@atomlin.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260825184637.888364-1-atomlin@atomlin.com> References: <20260825184637.888364-1-atomlin@atomlin.com> Content-Transfer-Encoding: 8bit Content-Type: text/plain X-ClientProxiedBy: LO4P123CA0107.GBRP123.PROD.OUTLOOK.COM (2603:10a6:600:191::22) To LO6P123MB6616.GBRP123.PROD.OUTLOOK.COM (2603:10a6:600:2b2::11) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: LO6P123MB6616:EE_|LO7P123MB7501:EE_ X-MS-Office365-Filtering-Correlation-Id: 094bb048-a1ca-4224-d5c8-08df02d93665 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|376014|7416014|1800799024|366016|10067099003|56012099006|18002099003|22082099003; X-Microsoft-Antispam-Message-Info: XRRlpz/lEqTQhcBmPzI1rQ9d7WqN9D0qzGBF7ISAqsNYSPLE7z/0MH+9GjagwmoUY+JrlKdZ+anVtLaAlb/3aMcow7Oghdeax8FtPSCfsEunFA7dsgHSPcuJpcQbegSukIv5AcxCRBUHCXEMy++AkHoB0WUjy4Ha1ZrlxYx+zh1OfJFY7Y3jlLmtSnDC0GSXkz4ssL+CB8M/aMZjFK1KZ/Xmj+nNgsEF+lKgfMOW8UYZ9o5hLqOjZi0S1nV2JoCIOuPBloWpZdtDXq1iDEgtDAn4mec1enpOJqS6dz8ShK4ELEqeR/PBndHnFRkuJxo5tf1lQdVqWnL55xa+pwCvRRaVp3BHsHWWV1roGdxAOF5U+8b3NSk++jS76MtFGh5MmXUNlemjLFnu/DioCnKeqnV11FiFapUiJoxTFe8rkJrswwwfthxxqZBfzg0Ox1AELGp6eCzxPeTI6mlXHivBYbznK4DNcJdFYNRBovH0FRXvmuN5h4qE2nELi1oEZPaFzIbGbSwUX9Au9jMjclg9TbTJE+Xs8Q9xSOu5lzqa+NJdpz1OmGE0M6xykk2+006MNb57Joj3miOmCS0LjiLRIVhXSr10f4a3kUYLnYyLppey/aoJ3X/sj/RE5L8iWwjOyHcvy1IkyfQL1vW1nW5hKB5l0RYqXpN43NsGtL8vbJk= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:LO6P123MB6616.GBRP123.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(376014)(7416014)(1800799024)(366016)(10067099003)(56012099006)(18002099003)(22082099003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?k1NsgB41akniUqME/Ld70VgV8u+EtnJiBseKMvxVYIauKVsWOBC7sCgH31SY?= =?us-ascii?Q?hlzUz5BibhmCx4CbOP39uX+FuiUeFQgbzsCsB/XCEyXel7fS7pi278H/1vGJ?= =?us-ascii?Q?O+Of+7JtD4AprTbc+Mp1GPDGtRgoQxPVgpK0l7VTY+AColfT77EgYjRyDvMy?= =?us-ascii?Q?YILfGiXxQCz10G7l9FGhIiWKNmSeT/enBK2etMtwTWSwcgvq+W21MKyUZYoT?= =?us-ascii?Q?bMLiT55djd1x96+i9GY4iPbnwcz8vnXRP6WP7EUVTQirLFPEzxuDox/4ROBp?= =?us-ascii?Q?hckpf01uKyqe9Lupqr02sZ1gSt2huoJB6DbIIxvGoA2EwULkwUYfqz7i8+9g?= =?us-ascii?Q?xT/sGSJxP7VWyCEHRudkLSpyLrCHfQHsi0DTowMShP/ac/UQ4KVLQT402GqK?= =?us-ascii?Q?QgDPnPYnBZxQsYfTkvigO204yxGAwm9uIEt6wD1HN4fwIFVP8iyzw92UcnEr?= =?us-ascii?Q?ZEhxmE2/A/XVuoy2SjLPFwNAhPtJ2OLqG57KOesqjUEQjHORrH08miygTVe7?= =?us-ascii?Q?L/F09okMf7Zi8klLCWBWg7z0MDDLWOINM8J6NXpjTSrSoEmVaadOZfobbCoc?= =?us-ascii?Q?HRtTeDMFEWxNba/ZkYq1R4pDSCyCNtqnSMkVBtQp7v3GWG0a7cq0/2s27Ekj?= =?us-ascii?Q?NZ1xfv6KetjT6Xc7BJpj6FWIw2O4c6ynhIJuCYDXynp9+UhuPjH+aSd8jY5P?= =?us-ascii?Q?rJyyUG1FTjRp+Y85c8ybh5xiLRmgNBeTwV2zVkCHHHpMkjPKJ6IKr0f7dzvA?= =?us-ascii?Q?NCMWCOi4uNR/kfDht0B/L+T5WmFSTCg8ZG1N/QJPO6jxi8PNhki/EZKP03Td?= =?us-ascii?Q?Fz6YiZQoxSkdsjT1y9stErMKc/52OdtDnsvJpkDvFRRDzuqLdi0nEgHHfFWG?= =?us-ascii?Q?g8Z09ubDQUWpezW2ryDGem3HSnNDYNzVYZDcOJEOgk9To4u9BMyXX4ma0Lfx?= =?us-ascii?Q?B6IhOP2250oonIq284F3rycnHoQKntXlBsdBgZs10rzhNrX3DaisgaGB1yuK?= =?us-ascii?Q?SdXY7XlBaQuwfbSRU1vsbISBvlG+k1kKMhqHYBlWvijCe8gNMmTQ8ZMQN54k?= =?us-ascii?Q?F/j8a01vMuGZwWpw2Vp0DW2AMcaZIj/O4bOvooffBUYLgxvpd4tIrGgzUuac?= =?us-ascii?Q?ibn459js+YnwU6qcK15q11l6STzJLjgDrxf4vnjgfBuD+fFx8n68YCHH1sor?= =?us-ascii?Q?EInTfTvhBunCm2T+pKQveRRJGFUCXMvAwV7OialtqTukdtAQTD+4fF98ZI3E?= =?us-ascii?Q?PcOuXLEcOvvaNYIxmgPrPIC9KJdxQ1cEVozMy4eoVJ3lw7bX6a8APZwgJOMk?= =?us-ascii?Q?Qx1jiDbkKtGuu/Ewl7yHry+JotBBFR2QJ8NOOtii4Sc6OHnKS5mVUPngYKkk?= =?us-ascii?Q?+HBulug/YoCKDLi9Pq6Q/cvIkbT+CU5KZiVK4NbUAyQhTntPvKwyhofrLITJ?= =?us-ascii?Q?tiDI8nPOz3kG8GMxvIg2z/NB6ANv9KGkC5gtJKRgSSMXS0XE96J54xcBvHyr?= =?us-ascii?Q?LAXIOttcnHV/AJDj2eXv8Jmj2/MBCjGp31TCkzbFy8RG+uFtY0YfbwBAExKa?= =?us-ascii?Q?wpJ937LUXWm+JQNj2hIuoqzrE8cc4m1+oElNPyZjrDwjmYZLoyq4Fsc+HO48?= =?us-ascii?Q?l5GBICNsKbvkt6mpDzWqyMCCFlSyYbQUBf/k0KeoFZ6P6LMAtkkiKYPt7ElI?= =?us-ascii?Q?pQHhKnA6vuBVbQq3r6bQLYmtnxWimipC3H1q05T5vqEiJoyq?= X-OriginatorOrg: atomlin.com X-MS-Exchange-CrossTenant-Network-Message-Id: 094bb048-a1ca-4224-d5c8-08df02d93665 X-MS-Exchange-CrossTenant-AuthSource: LO6P123MB6616.GBRP123.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 25 Aug 2026 18:46:45.4348 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: e6a32402-7d7b-4830-9a2b-76945bbbcb57 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: JDsTkbD8MiHMr+KtxXdWzyS9sbn1qRWK43m7/jLqPvnnu1Nh5EnxDNrAIaF25fzapmhSVbJRuRTaHa8RmtmAGQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO7P123MB7501 In print_cpu(), rq->curr is dereferenced locklessly to print the current task's PID via task_pid_nr(rq->curr). While accessing /sys/kernel/debug/sched/debug is inherently best-effort only; rq->curr is indeed expected to change dynamically while print_cpu() is executing. However, if the task currently running on the CPU exits concurrently and its reference count drops to zero, put_task_struct() calls call_rcu() to schedule __put_task_struct_rcu_cb(). Because print_cpu() does not hold the RCU read lock while dereferencing rq->curr, an RCU grace period can complete concurrently and free the task structure via free_task(), creating a potential use-after-free race condition. Resolve this by reading rq->curr using rcu_dereference(rq->curr) inside an RCU read-side critical section. Holding the RCU read lock delays the invocation of __put_task_struct_rcu_cb() until after rcu_read_unlock(), ensuring that the struct task_struct memory remains valid while being accessed. Fixes: 02968ccf7b80 ("sched: add /proc/sched_debug file") Reported-by: sashiko-bot Signed-off-by: Aaron Tomlin --- kernel/sched/debug.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c index b8be86bf8849..2949e6ce753d 100644 --- a/kernel/sched/debug.c +++ b/kernel/sched/debug.c @@ -1210,7 +1210,10 @@ do { \ P(nr_switches); P(nr_uninterruptible); PN(next_balance); - SEQ_printf(m, " .%-30s: %ld\n", "curr->pid", (long)(task_pid_nr(rq->curr))); + rcu_read_lock(); + SEQ_printf(m, " .%-30s: %ld\n", "curr->pid", + (long)(task_pid_nr(rcu_dereference(rq->curr)))); + rcu_read_unlock(); PN(clock); PN(clock_task); #undef P -- 2.55.0