Sched_ext development
 help / color / mirror / Atom feed
From: sashiko-bot@kernel.org
To: "Tejun Heo" <tj@kernel.org>
Cc: hannes@cmpxchg.org, mkoutny@suse.com, tj@kernel.org,
	sched-ext@lists.linux.dev
Subject: Re: [PATCH 1/2] sched/psi: Create the psimon kthread outside of cgroup_mutex
Date: Sun, 12 Jul 2026 18:00:31 +0000	[thread overview]
Message-ID: <20260712180032.087AF1F000E9@smtp.kernel.org> (raw)
In-Reply-To: <20260712174619.3553231-2-tj@kernel.org>

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Calling psi_trigger_destroy() while holding cgroup_mutex introduces severe system-wide latency spikes.
--

--- Patch [1]: [PATCH 1/2] sched/psi: Create the psimon kthread outside of cgroup_mutex ---
commit 4990aba341f12c025b0b99ecf8869c68be847294
Author: Tejun Heo <tj@kernel.org>
sched/psi: Create the psimon kthread outside of cgroup_mutex

This commit splits psi trigger creation into two stages to avoid locking
dependencies. It drops cgroup_mutex before forking the psimon kthread, then
reacquires the mutex to verify the cgroup is still alive before publishing
the new trigger.

Closes: https://lore.kernel.org/all/20260710100441.2653477-1-matt@readmodwrite.com/

> diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
> index 38f8d9df8fbc4..b5b461d4418b1 100644
> --- a/kernel/cgroup/cgroup.c
> +++ b/kernel/cgroup/cgroup.c
[ ... ]
> @@ -4015,12 +4016,32 @@ static ssize_t pressure_write(struct kernfs_open_file *of, char *buf,
>  	}
>  
>  	psi = cgroup_psi(cgrp);
> -	new = psi_trigger_create(psi, buf, res, of->file, of);
> +	new = psi_trigger_create(psi, buf, res, of->file, of,
> +				 &need_rtpoll_worker);
>  	if (IS_ERR(new)) {
>  		ret = PTR_ERR(new);
>  		goto out_unlock;
>  	}
>  
> +	/*
> +	 * The worker fork must run with neither cgroup_mutex nor the file's
> +	 * kernfs active reference held. The latter is broken since
> +	 * cgroup_kn_lock_live(). @of->priv may be released while unlocked, so
> +	 * recheck before publishing @new.
> +	 */
> +	if (need_rtpoll_worker) {
> +		cgroup_unlock();
> +		ret = psi_trigger_create_rtpoll_worker(psi);
> +		cgroup_lock();
> +
> +		if (!ret && !of->priv)
> +			ret = -ENODEV;
> +		if (ret) {
> +			psi_trigger_destroy(new);

[Severity: High]
Since psi_trigger_destroy() unconditionally blocks on synchronize_rcu(), will
calling it here while holding cgroup_mutex cause system-wide latency spikes?

Looking at psi_trigger_destroy() in kernel/sched/psi.c, it does:

	/*
	 * Wait for psi_schedule_rtpoll_work RCU to complete its read-side
	 * critical section before destroying the trigger and optionally the
	 * rtpoll_task.
	 */
	synchronize_rcu();

If this error path is reached (e.g. by racing pressure_write() with cgroup
rmdir making of->priv NULL), the calling thread would sleep for an RCU grace
period while holding cgroup_mutex, stalling all other cgroup operations.

Could the trigger destruction be deferred until after cgroup_mutex is dropped,
or handled asynchronously to avoid stalling the cgroup subsystem?

> +			goto out_unlock;
> +		}
> +	}
> +
>  	smp_store_release(&ctx->psi.trigger, new);
>  
>  out_unlock:

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260712174619.3553231-1-tj@kernel.org?part=1

  reply	other threads:[~2026-07-12 18:00 UTC|newest]

Thread overview: 13+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-07-12 17:46 [PATCHSET v2] sched/psi: Fix psimon fork deadlock and rtpoll_timer UAF Tejun Heo
2026-07-12 17:46 ` [PATCH 1/2] sched/psi: Create the psimon kthread outside of cgroup_mutex Tejun Heo
2026-07-12 18:00   ` sashiko-bot [this message]
2026-07-12 20:26     ` Tejun Heo
2026-07-13 10:51   ` Johannes Weiner
2026-07-13 13:48   ` Matt Fleming
2026-07-13 15:19     ` Suren Baghdasaryan
2026-07-12 17:46 ` [PATCH 2/2] sched/psi: Shut down rtpoll_timer in psi_cgroup_free() Tejun Heo
2026-07-13 10:56   ` Johannes Weiner
2026-07-13 14:07     ` Suren Baghdasaryan
2026-07-13 15:19       ` Suren Baghdasaryan
2026-07-13 13:48   ` Matt Fleming
2026-07-13 13:49 ` [PATCHSET v2] sched/psi: Fix psimon fork deadlock and rtpoll_timer UAF Matt Fleming

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260712180032.087AF1F000E9@smtp.kernel.org \
    --to=sashiko-bot@kernel.org \
    --cc=hannes@cmpxchg.org \
    --cc=mkoutny@suse.com \
    --cc=sashiko-reviews@lists.linux.dev \
    --cc=sched-ext@lists.linux.dev \
    --cc=tj@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox