From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from CWXP265CU008.outbound.protection.outlook.com (mail-ukwestazon11020115.outbound.protection.outlook.com [52.101.195.115]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EC59B3B0AFB for ; Tue, 25 Aug 2026 18:46:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.195.115 ARC-Seal:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787683614; cv=fail; b=c/CERBeXWBIUCwX9YHTaja5vUgdUf8WVT9FEC8uNWD4eJW/yPy8Y9ZSm7g2n204mUbtgn5rM22sbgJ8QE8iAgPg0Hp3xmx4rvbavZzaPbIKVJL3X39RTTqW4iDsw3e9tjUCu+qpI+Oi5qYXVQ4EFDcTg/7ll4/cbvVkxXJ+Tk80= ARC-Message-Signature:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787683614; c=relaxed/simple; bh=AOvXL1FiZbh7jBBHxWHb8ru8JIYgeWp5gL48/7CwlNU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: Content-Type:MIME-Version; b=DXrlbzSkGUlZG82TDUcKFXa8oKpakO3eIPH9RONKImldyb3mVAaKnO2gdADzlTRBdn0eSGt1gls1QvaXuOsnoU/ef4aKgYDZBFCIy+wuUZLp81uMnHqzf9As184RyN7LFxEcQNnIaqSLw/XD7z6ge5R8wXN77OpHfYt9dyotHzk= ARC-Authentication-Results:i=2; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=atomlin.com; spf=pass smtp.mailfrom=atomlin.com; arc=fail smtp.client-ip=52.101.195.115 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=atomlin.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=atomlin.com ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=RW5qp1b9XMTUCOKcRWd/toBeBJAptLvXMvrd2S8XZNkEwOcB5rJwhXMfgmwS/xFTFdctVPE9qsi3hUl8A4ON2pWZUGavKLl4VvzP8gFjcHK4lhbgJIqHmBm5nI99X/zWakRGij4Lg4L2vq1xkdlF0yjpunnfK42TEam7sR9hA8uO+R7y4wj617zjKAMoPXwgQi18YgVdl4G/Ij2vVLpDgcudAsmDU+83wgxdFY6U7lLshUvgYtvahYnf0S/iyk9GAjVMdttD0wnqahc+7hHxxww4UHmeOBmrLlA5Kq+Kmpcyo18wayfDm5nwnYUKyifQ8lI0KLMFY48BfBNkDCK9eQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:MIME-Version; bh=gZodYWiNrUAcsvo6eVOxBWVXHILnkwJuR9fjL6RKnGg=; b=s8+33gGH+Skg7WSkNprvxkG1R76BpGzC1eHy21q6TJMXpBUOOdXyMIVaXYcICzqCX89d0USFMJKsVWfAffe7E1YM4IFsdRVxNW6imQ4qe+7+xPoeH3XyChf13X6NrffNhI3K8jD2LCIuqJC+aDgyAId1hk7MFepPUbVzKx//DABLMJn8KAQVyxxFhGLa7lSh5z4DDooe7vItgI55mFAIaA/g99Fe8eNgJSlCGReYM+xjZ6S2M0ybW+M3PThtYAOYaEJ0EWTxh0LJegDlkY3aChjgPFqPnRSDo9dhqd18B/UrMCjQ22PW6XqDKW24i7zSubJGECqq/grxWOgcc7LGQw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=atomlin.com; dmarc=pass action=none header.from=atomlin.com; dkim=pass header.d=atomlin.com; arc=none Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=atomlin.com; Received: from LO6P123MB6616.GBRP123.PROD.OUTLOOK.COM (2603:10a6:600:2b2::11) by LO7P123MB7501.GBRP123.PROD.OUTLOOK.COM (2603:10a6:600:40c::8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.360.8; Tue, 25 Aug 2026 18:46:47 +0000 Received: from LO6P123MB6616.GBRP123.PROD.OUTLOOK.COM ([fe80::3975:c5e7:bc1a:f383]) by LO6P123MB6616.GBRP123.PROD.OUTLOOK.COM ([fe80::3975:c5e7:bc1a:f383%4]) with mapi id 15.21.0360.005; Tue, 25 Aug 2026 18:46:47 +0000 From: Aaron Tomlin To: mingo@redhat.com, peterz@infradead.org, juri.lelli@redhat.com, vincent.guittot@linaro.org Cc: dietmar.eggemann@arm.com, rostedt@goodmis.org, bsegall@google.com, mgorman@suse.de, vschneid@redhat.com, kprateek.nayak@amd.com, zhanxusheng1024@gmail.com, neelx@suse.com, atomlin@atomlin.com, chjohnst@mail.com, mproche@mail.com, sean@ashe.io, steve@abita.co, rishil1999@outlook.com, linux-kernel@vger.kernel.org Subject: [PATCH v6 4/6] sched/debug: Protect p->mm access in sched_show_numa() Date: Tue, 25 Aug 2026 14:46:35 -0400 Message-ID: <20260825184637.888364-5-atomlin@atomlin.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260825184637.888364-1-atomlin@atomlin.com> References: <20260825184637.888364-1-atomlin@atomlin.com> Content-Transfer-Encoding: 8bit Content-Type: text/plain X-ClientProxiedBy: LO2P123CA0088.GBRP123.PROD.OUTLOOK.COM (2603:10a6:600:138::21) To LO6P123MB6616.GBRP123.PROD.OUTLOOK.COM (2603:10a6:600:2b2::11) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: LO6P123MB6616:EE_|LO7P123MB7501:EE_ X-MS-Office365-Filtering-Correlation-Id: 120193a4-8649-4889-5e58-08df02d9379e X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|376014|7416014|1800799024|366016|10067099003|56012099006|18002099003|22082099003; X-Microsoft-Antispam-Message-Info: /PocrnE/b8JQtz4trJ+9OAeSwIof5JgSu+XMAhmx0iM8/rtxnH2jmaJ9KrpgKOWgNpkBL+VBxBMnOyDd0Bz2Z+2yv62rELWY7czs2FkKVnmS3jaQ8589inXIjb/et/Jp9Xx9hfQzopZH52BfEFXUFN0XB6p+hA7fEpAUa+168YA0r4Z323HvL7EPdMqswT0ThBPaWVCBWdoeLsiDIGh0k9md/2Q33kPxk1xEDFLa3ZG3ob6KrdpmY5XICNUnqNwPkVlnmZm0tnSGqHACCGQm7gthq2uflJbpbI9bOVIRiTh7I88tNt3XTfVCPJGTJOZn+8/PaHpnffdcEcTTUP7qbfQIGLY+WMwcrG9JCDQquJGDAGmrDANo51m9PZT5G4v3Opz85HQD8GEvfc4kPWmtD3GYacNwVezMQlpPpPibZ5ss1vuQEOYBtpaJuxkqL1dilJIAOAwuivbrPpL8tJsQTMDag1ukXm7GGvhEjRShKvaPyr4SPCTR2aEaq4dbkYW4lgOPaA3pvi+z7IpjbSiW37vBOE/dps3BjLSEk9rFLKnEZdxayu/urkOMiCFm8ub/3AE/cJR1Uv/tpTCvZbAeXxcIa074P3NCOXMMb2YOnBTLDIsq/TTf03GX/+Y7hrOzNb15HePBEONcJxsKEO/RKi11bTqAgqYB6xS4HuLaDPE= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:LO6P123MB6616.GBRP123.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(376014)(7416014)(1800799024)(366016)(10067099003)(56012099006)(18002099003)(22082099003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?97oEb/JWWapU1/ivD0qWYf9aAdcPDodlqTtefUMT9QOpU7ub0u7aobHCgd2P?= =?us-ascii?Q?aluEwcC5RLayOocfsqvmbYRCQ8o4p5uX5TBCHVpKrNujRejrThIHfwQFKmZh?= =?us-ascii?Q?ZZt57j67YkBrbQ/BK3BmL5+38CL+3dWdpxFs/zb7Uw1wf+BYW6FlE/tGSa1w?= =?us-ascii?Q?vxGl1qWh3ANoYLcn6w5PlVnbJsh/3++sCMlftL6CWoMP3VBPos7X3LMj+m2P?= =?us-ascii?Q?pSLn2CHO58/WB52nRI3L5/+SjYwQgQLB+3JJNAyqsvmVsuejHPFaPi2xYl2T?= =?us-ascii?Q?JJAMAENJbOjyi7ZfFm84OtUsUrbtJR1I5eLCOEqpMZ2atoennf1fYLwY9eka?= =?us-ascii?Q?uUuWQxqVeouS8fhbeylwtRBmYsBfIx5wRSlTQNB0UCTrEcNsWidEZAN5Kikj?= =?us-ascii?Q?sUGsO4slRkm/o93192UFC6y3yAEfBFuWfC/stLs4kFsCFlWuojqZ2YEVKlrk?= =?us-ascii?Q?MshfzSvOJ6yoLXOIDitki5rSZJ9+MYofVMXhm34SwAPTs5dEdMg1GdxTvXIL?= =?us-ascii?Q?NRDK3PZXo9wMvwGLJnUbRwchDiMgYM2APbCT5s20dcJwuavfG9Wq7ByGfQQn?= =?us-ascii?Q?/nefUE3PcVDOT0dQkjfhgKYLTFxS2eSR+D3gVeixljgFQcla2f2Lyklix7pr?= =?us-ascii?Q?ZNc3PDaiFee3LNVnW18M4Yqih0iSB0WoLPgAhQYpXrnTaFBImpWDGU49QUde?= =?us-ascii?Q?XXfL0v/2YKx2CT0Ky5TS8sUpk6mqW/LjTu3wTPS+/AFWEcpN5KSDGg4Ka/mT?= =?us-ascii?Q?IKeF+okU38sQi8Ms+j3mAh/8CYqMBB7kv+DVJp5zmfB/ns52tIf+R/UiVRQp?= =?us-ascii?Q?5ZLQ8OJgXjV2dSkEAUfCRlv2N9wekif6BTC8FRfgdf8iypLcqERAothvkCyG?= =?us-ascii?Q?2HMS6QHZXFFAnjJVvBDU2cCnUhGtl1KeKyQM+oA8lwADcc/LtExM2FCd9Gem?= =?us-ascii?Q?0thDltqjBY7DnJgYQ7wHU2xMGfFRjXM9DBZpKK2oidCKkMVMsYl3S3z6baUw?= =?us-ascii?Q?PEvXTQGafOrI+TjAqRvI3ljufkQ7nmMvsCzEOr36/6wIlfTspf49CF+Boutr?= =?us-ascii?Q?p0TWifg8TzcZfoj88+Lr9ndpudDHS9dVlypkVn4G3AmnUKxjFt0b4njXOnqL?= =?us-ascii?Q?/ZnnJ/AKvCWgk7y+wPGUEKGD/vLhZE3KnLFLtkM7NDtNNi49CG1ernE64ZoL?= =?us-ascii?Q?aSOTiqQ3v04VRE8qwh+evr6kePhCOJOHQe2oZwmDKCTRXVYV+VdADYDUymZr?= =?us-ascii?Q?KnVwD9HXNZ80lSlJ4wRZCyHMOUkqHT1N8Q1TH/jmO+qe8gW6P7c01AQiSV5P?= =?us-ascii?Q?ZDrKnwb3SA3xL3yrG0fkDx8Xpy7xZBSR4erVIQzxwZv2RbzVbVIamE66D2Xj?= =?us-ascii?Q?x8fHUZjHp7T1aED++unmhL+E5ly5RQcEyOACmEqRHSiD0hLw2WL+RvJKignq?= =?us-ascii?Q?dLoYjwiFWyRnIt8mRF5wTCACPETOjmdoTam7bUdGLOhZ79rEfNhVRyCQjKZY?= =?us-ascii?Q?50lpQSrtHb0/LqjparsbH6jK61UUuOpxHMNDFb8j67J5a2/KgR7GqnzhjIP+?= =?us-ascii?Q?2xYjvD4U66OiJSzZdX1geXJiFnh0tvlFyX/GIhmvDo2Tap1ReVGaImeIU6t1?= =?us-ascii?Q?UaeL3kcjHOD83fiU7y9v1BHDwogTs11fnpdLFotNKjg828njBvdOyOTh04Qy?= =?us-ascii?Q?3M7SHhwk7KlkQVpNXmqbWsdwSd53IsJvnutDGXZUtyLwdwDQ?= X-OriginatorOrg: atomlin.com X-MS-Exchange-CrossTenant-Network-Message-Id: 120193a4-8649-4889-5e58-08df02d9379e X-MS-Exchange-CrossTenant-AuthSource: LO6P123MB6616.GBRP123.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 25 Aug 2026 18:46:47.4997 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: e6a32402-7d7b-4830-9a2b-76945bbbcb57 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 9VdBWmJxoXOXEETgs0VkSEDdXS5hFxVt6M74NNEaaUNg8wvAEEheQjToyE4HagJwKUIdhQnkjEiWfmKzu8TgXw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO7P123MB7501 In sched_show_numa(), p->mm is checked locklessly and then passed to the P(mm->numa_scan_seq) macro. This presents both a time-of-change to time-of-use race and a potential use-after-free vulnerability. If a task exits concurrently via exit_mm(p), another CPU can set p->mm to NULL and call mmput(mm) to free the struct mm_struct. Dereferencing mm->numa_scan_seq without holding task_lock(p) can access freed memory if mmput() runs immediately after the check. Fix this by wrapping the p->mm check and macro dereference in task_lock(p) and task_unlock(p). In exit_mm(), current->mm is set to NULL under task_lock(p) before mmput() is called, guaranteeing that p->mm cannot be set to NULL or freed while task_lock(p) is held. Fixes: b32e86b4301e ("sched/numa: Add debugging") Reported-by: sashiko-bot Signed-off-by: Aaron Tomlin --- kernel/sched/debug.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c index 2949e6ce753d..2a01854f0f1c 100644 --- a/kernel/sched/debug.c +++ b/kernel/sched/debug.c @@ -1395,8 +1395,10 @@ void print_numa_stats(struct seq_file *m, int node, unsigned long tsf, static void sched_show_numa(struct task_struct *p, struct seq_file *m) { #ifdef CONFIG_NUMA_BALANCING + task_lock(p); if (p->mm) P(mm->numa_scan_seq); + task_unlock(p); P(numa_pages_migrated); P(numa_preferred_nid); -- 2.55.0