Re: [PATCH sched_ext/for-7.3 18/32] sched_ext: Maintain per-cpu effective cap copies for single-read checks

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Unconditional array indexing with a potentially negative CID in `scx_process_sync_ecaps()` causes out-of-bounds reads for CPUs without a valid CID.
--

commit 8b6bde8377767baa9501eb855a3f0e41f5b5ad02
Author: Tejun Heo <tj@kernel.org>

sched_ext: Maintain per-cpu effective cap copies for single-read checks

This commit introduces scx_sched_pcpu->ecaps to maintain per-cpu effective
capability copies. Grant and revoke operations queue sync requests on the
target CPU's runqueue, which are then processed locklessly under the rq lock.

[ ... ]
> diff --git a/kernel/sched/ext/sub.c b/kernel/sched/ext/sub.c
> index c821d604ac9da..08d9367cf2188 100644
> --- a/kernel/sched/ext/sub.c
> +++ b/kernel/sched/ext/sub.c
[ ... ]
> @@ -283,6 +283,125 @@ static void scx_sub_seed_caps(struct scx_sched *sch)
>  	caps_updated_deliver(&to_deliver);
>  }
>  
[ ... ]
> +void scx_process_sync_ecaps(struct rq *rq)
> +{
> +	s32 cid = __scx_cpu_to_cid(cpu_of(rq));
> +	s32 shard = scx_cid_to_shard[cid];

[Severity: High]
Can this cause an out-of-bounds array access if the CPU does not have a valid
CID?

If scx_cid_init() fails, it can leave scx_cpu_to_cid_tbl with -1 sentinels
for some CPUs. The error handling then disables the scheduler, triggering
scx_sched_free_rcu_work() which iterates over all possible CPUs and calls
scx_process_sync_ecaps() on them.

Because scx_cid_to_shard[cid] is evaluated unconditionally here before the
llist_empty() check, a CID of -1 will index outside the scx_cid_to_shard
array and potentially cause a page fault.

> +	struct llist_node *batch, *pos, *tmp;
> +
> +	lockdep_assert_rq_held(rq);
> +
> +	if (likely(llist_empty(&rq->scx.ecaps_to_sync)))
> +		return;
> +
> +	batch = llist_del_all(&rq->scx.ecaps_to_sync);
[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260703080159.2314350-1-tj@kernel.org?part=18