torvalds/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-30 00:29:35 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

tools/sched_ext: Fix off-by-one in scx_sdt payload zeroing

Browse Source 
scx_alloc_free_idx() zeroes the payload of a freed arena allocation
one word at a time. The loop bound was alloc->pool.elem_size / 8, but
elem_size includes sizeof(struct sdt_data) (the 8-byte union sdt_id
header). This caused the loop to write one extra u64 past the
allocation, corrupting the tid field of the adjacent pool element.

Fix the loop bound to (elem_size - sizeof(struct sdt_data)) / 8 so
only the payload portion is zeroed.

Test plan:
- Add a temporary sanity check in scx_task_free() before the free call:

  if (mval->data->tid.idx != mval->tid.idx)
      scx_bpf_error("tid corruption: arena=%d storage=%d",
                    mval->data->tid.idx, (int)mval->tid.idx);

- stress-ng --fork 100 -t 10 & sudo ./build/bin/scx_sdt

Without this fix, running scx_sdt under fork-heavy load triggers the
corruption error. With the fix applied, the same workload completes
without error.

Fixes: 36929ebd17 ("tools/sched_ext: add arena based scheduler")
Signed-off-by: Cheng-Yang Chou <yphbchou0911@gmail.com>
Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
This commit is contained in:
Cheng-Yang Chou
2026-03-31 17:18:33 +08:00
committed by Tejun Heo
parent 744ab12a5b
commit a3c3fb2f86
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
tools/sched_ext/scx_sdt.bpf.c
View File

@@ -317,7 +317,8 @@ int scx_alloc_free_idx(struct scx_allocator *alloc, __u64 idx)
};
/* Zero out one word at a time. */
for (i = zero; i < alloc->pool.elem_size / 8 && can_loop; i++) {
for (i = zero; i < (alloc->pool.elem_size - sizeof(struct sdt_data)) / 8
&& can_loop; i++) {
data->payload[i] = 0;
}
}