linux-kernel - [tip: sched/urgent] sched/deadline: Fix potential race in dl_add_task_root

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <176830100616.510.8848475494579626153.tip-bot2@tip-bot2>
Date: Tue, 13 Jan 2026 10:43:26 -0000
From: "tip-bot2 for Pingfan Liu" <tip-bot2@...utronix.de>
To: linux-tip-commits@...r.kernel.org
Cc: Juri Lelli <juri.lelli@...hat.com>, Pingfan Liu <piliu@...hat.com>,
 "Peter Zijlstra (Intel)" <peterz@...radead.org>,
 Waiman Long <longman@...hat.com>, x86@...nel.org,
 linux-kernel@...r.kernel.org
Subject: [tip: sched/urgent] sched/deadline: Fix potential race in
 dl_add_task_root_domain()

The following commit has been merged into the sched/urgent branch of tip:

Commit-ID:     64e6fa76610ec970cfa8296ed057907a4b384ca5
Gitweb:        https://git.kernel.org/tip/64e6fa76610ec970cfa8296ed057907a4b384ca5
Author:        Pingfan Liu <piliu@...hat.com>
AuthorDate:    Tue, 25 Nov 2025 11:26:30 +08:00
Committer:     Peter Zijlstra <peterz@...radead.org>
CommitterDate: Tue, 13 Jan 2026 11:37:51 +01:00

sched/deadline: Fix potential race in dl_add_task_root_domain()

The access rule for local_cpu_mask_dl requires it to be called on the
local CPU with preemption disabled. However, dl_add_task_root_domain()
currently violates this rule.

Without preemption disabled, the following race can occur:

1. ThreadA calls dl_add_task_root_domain() on CPU 0
2. Gets pointer to CPU 0's local_cpu_mask_dl
3. ThreadA is preempted and migrated to CPU 1
4. ThreadA continues using CPU 0's local_cpu_mask_dl
5. Meanwhile, the scheduler on CPU 0 calls find_later_rq() which also
   uses local_cpu_mask_dl (with preemption properly disabled)
6. Both contexts now corrupt the same per-CPU buffer concurrently

Fix this by moving the local_cpu_mask_dl access to the preemption
disabled section.

Closes: https://lore.kernel.org/lkml/aSBjm3mN_uIy64nz@jlelli-thinkpadt14gen4.remote.csb
Fixes: 318e18ed22e8 ("sched/deadline: Walk up cpuset hierarchy to decide root domain when hot-unplug")
Reported-by: Juri Lelli <juri.lelli@...hat.com>
Signed-off-by: Pingfan Liu <piliu@...hat.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@...radead.org>
Acked-by: Juri Lelli <juri.lelli@...hat.com>
Acked-by: Waiman Long <longman@...hat.com>
Link: https://patch.msgid.link/20251125032630.8746-3-piliu@redhat.com
---
 kernel/sched/deadline.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
index 463ba50..e3efc40 100644
--- a/kernel/sched/deadline.c
+++ b/kernel/sched/deadline.c
@@ -3154,7 +3154,7 @@ void dl_add_task_root_domain(struct task_struct *p)
 	struct rq *rq;
 	struct dl_bw *dl_b;
 	unsigned int cpu;
-	struct cpumask *msk = this_cpu_cpumask_var_ptr(local_cpu_mask_dl);
+	struct cpumask *msk;
 
 	raw_spin_lock_irqsave(&p->pi_lock, rf.flags);
 	if (!dl_task(p) || dl_entity_is_special(&p->dl)) {
@@ -3162,6 +3162,7 @@ void dl_add_task_root_domain(struct task_struct *p)
 		return;
 	}
 
+	msk = this_cpu_cpumask_var_ptr(local_cpu_mask_dl);
 	dl_get_task_effective_cpus(p, msk);
 	cpu = cpumask_first_and(cpu_active_mask, msk);
 	BUG_ON(cpu >= nr_cpu_ids);