Re: [PATCH v3 sched_ext/for-7.3 16/36] sched_ext: Build the set_cmask scratch from trusted geometry

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] The functions `scx_cpumask_to_cmask` and `scx_cmask_clear` were left in the codebase despite being completely unused after this patch.
--

--- Patch [16]: [PATCH v3 sched_ext/for-7.3 16/36] sched_ext: Build the set_cmask scratch from trusted geometry ---
commit aafcbdb12be7e475e0dfdb8c0906f3356f2353dd
Author: Tejun Heo <tj@kernel.org>

sched_ext: Build the set_cmask scratch from trusted geometry

scx_call_op_set_cpumask() builds a per-cpu cmask in the set_cmask scratch,
which lives in BPF-writable arena. A scheduler can corrupt the scratch's
inline header (base, nr_cids, alloc_words) from another cpu, so sizing and
indexing the write from it risks an out-of-bounds write.

[ ... ]

> diff --git a/kernel/sched/ext/ext.c b/kernel/sched/ext/ext.c
> index a5e782147bf40..8ee980f822aac 100644
> --- a/kernel/sched/ext/ext.c
> +++ b/kernel/sched/ext/ext.c
> @@ -412,12 +412,15 @@ static inline void scx_call_op_set_cpumask(struct scx_sched *sch, struct rq *rq,
>  {
>  	if (scx_is_cid_type()) {
>  		struct scx_cmask *kern_va = *this_cpu_ptr(sch->set_cmask_scratch);
> +		struct scx_cmask_ref ref;
> +
>  		/*
> -		 * Build the per-CPU arena cmask and hand BPF its arena address.
> -		 * Caller holds the rq lock with IRQs disabled, which makes us
> -		 * the sole user of the scratch area.
> +		 * Build the per-cpu arena cmask from kernel geometry via @ref,
> +		 * never reading its BPF-writable header, and hand BPF the arena
> +		 * address. The rq lock makes this cpu the sole kernel writer.
>  		 */
> -		scx_cpumask_to_cmask(cpumask, kern_va);

[Severity: Low]
With this removal of the call to scx_cpumask_to_cmask(), it looks like
scx_cpumask_to_cmask() and its helper scx_cmask_clear() are now completely
unused.

Should their definitions and declarations in kernel/sched/ext/cid.c and
kernel/sched/ext/cid.h be removed as well to avoid leaving dead code?

> +		scx_cmask_ref_init_kern(sch, kern_va, 0, num_possible_cpus(), &ref);
> +		scx_cmask_ref_from_cpumask(&ref, cpumask);
>  		SCX_CALL_CID_OP_TASK(sch, set_cmask, rq, task,
>  				     scx_kaddr_to_arena(sch, kern_va));
>  	} else {

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260707001229.1410929-1-tj@kernel.org?part=16