summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-04-27spi: rzv2h-rspi: Fix silent failure in clock setup error pathJohn Madieu
rzv2h_rspi_setup_clock() is declared to return u32 but returns -EINVAL when no valid clock parameters are found. Cast to u32, -EINVAL becomes 0xffffffea, which is a non-zero value. The caller in rzv2h_rspi_prepare_message() guards against failure with: rspi->freq = rzv2h_rspi_setup_clock(rspi, speed_hz); if (!rspi->freq) return -EINVAL; Because 0xffffffea is non-zero, the check is bypassed and the controller proceeds to program SPBR/SPCMD with stale values, leading to an unknown bit rate. Return 0 on the failed-search path, consistent with the existing clk_set_rate() failure path which already returns 0. Fixes: 77d931584dd3 ("spi: rzv2h-rspi: make transfer clock rate finding chip-specific") Signed-off-by: John Madieu <john.madieu.xa@bp.renesas.com> Reviewed-by: Biju Das <biju.das.jz@bp.renesas.com> Reviewed-by: Cosmin Tanislav <cosmin-gabriel.tanislav.xa@renesas.com> Link: https://patch.msgid.link/20260425024725.2393632-1-john.madieu.xa@bp.renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-04-26driver core: Replace dev->dma_coherent with dev_dma_coherent()Douglas Anderson
In C, bitfields are not necessarily safe to modify from multiple threads without locking. Switch "dma_coherent" over to the "flags" field so modifications are safe. Cc: Christoph Hellwig <hch@lst.de> Reviewed-by: Rafael J. Wysocki (Intel) <rafael@kernel.org> Reviewed-by: Danilo Krummrich <dakr@kernel.org> Acked-by: Vinod Koul <vkoul@kernel.org> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Acked-by: Marek Szyprowski <m.szyprowski@samsung.com> Signed-off-by: Douglas Anderson <dianders@chromium.org> Link: https://patch.msgid.link/20260406162231.v5.7.If839f6dde98979fce177f70c6c74689a1904ee76@changeid [ Since all DEV_FLAG_DMA_COHERENT accessors are exposed unconditionally, also drop the CONFIG guards around dev_assign_dma_coherent() in device_initialize() to ensure a correct default value. - Danilo ] Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-04-26driver core: Replace dev->state_synced with dev_state_synced()Douglas Anderson
In C, bitfields are not necessarily safe to modify from multiple threads without locking. Switch "state_synced" over to the "flags" field so modifications are safe. Cc: Saravana Kannan <saravanak@kernel.org> Reviewed-by: Rafael J. Wysocki (Intel) <rafael@kernel.org> Reviewed-by: Danilo Krummrich <dakr@kernel.org> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Acked-by: Marek Szyprowski <m.szyprowski@samsung.com> Signed-off-by: Douglas Anderson <dianders@chromium.org> Link: https://patch.msgid.link/20260406162231.v5.6.Idb4818e1159fef104c7756bfd6e7ba8f374bebcd@changeid Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-04-26driver core: Replace dev->dma_ops_bypass with dev_dma_ops_bypass()Douglas Anderson
In C, bitfields are not necessarily safe to modify from multiple threads without locking. Switch "dma_ops_bypass" over to the "flags" field so modifications are safe. Cc: Christoph Hellwig <hch@lst.de> Cc: Alexey Kardashevskiy <aik@ozlabs.ru> Reviewed-by: Rafael J. Wysocki (Intel) <rafael@kernel.org> Reviewed-by: Danilo Krummrich <dakr@kernel.org> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Acked-by: Marek Szyprowski <m.szyprowski@samsung.com> Signed-off-by: Douglas Anderson <dianders@chromium.org> Link: https://patch.msgid.link/20260406162231.v5.5.If62b84471ef2c85e7ad250f0468867d6dba965ab@changeid Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-04-26driver core: Replace dev->dma_skip_sync with dev_dma_skip_sync()Douglas Anderson
In C, bitfields are not necessarily safe to modify from multiple threads without locking. Switch "dma_skip_sync" over to the "flags" field so modifications are safe. Cc: Alexander Lobakin <aleksander.lobakin@intel.com> Cc: Eric Dumazet <edumazet@google.com> Cc: Christoph Hellwig <hch@lst.de> Reviewed-by: Rafael J. Wysocki (Intel) <rafael@kernel.org> Reviewed-by: Danilo Krummrich <dakr@kernel.org> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Acked-by: Marek Szyprowski <m.szyprowski@samsung.com> Signed-off-by: Douglas Anderson <dianders@chromium.org> Link: https://patch.msgid.link/20260406162231.v5.4.Icf072aa4184dd86a88fa8ca195b09d1651984000@changeid Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-04-26driver core: Replace dev->dma_iommu with dev_dma_iommu()Douglas Anderson
In C, bitfields are not necessarily safe to modify from multiple threads without locking. Switch "dma_iommu" over to the "flags" field so modifications are safe. Cc: Leon Romanovsky <leon@kernel.org> Cc: Robin Murphy <robin.murphy@arm.com> Cc: Christoph Hellwig <hch@lst.de> Reviewed-by: Rafael J. Wysocki (Intel) <rafael@kernel.org> Reviewed-by: Danilo Krummrich <dakr@kernel.org> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Acked-by: Marek Szyprowski <m.szyprowski@samsung.com> Signed-off-by: Douglas Anderson <dianders@chromium.org> Link: https://patch.msgid.link/20260406162231.v5.3.Id20d5973cbff542fea290e13177e9423f5d81342@changeid Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-04-26driver core: Replace dev->can_match with dev_can_match()Douglas Anderson
In C, bitfields are not necessarily safe to modify from multiple threads without locking. Switch "can_match" over to the "flags" field so modifications are safe. Cc: Saravana Kannan <saravanak@kernel.org> Reviewed-by: Rafael J. Wysocki (Intel) <rafael@kernel.org> Reviewed-by: Danilo Krummrich <dakr@kernel.org> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Acked-by: Marek Szyprowski <m.szyprowski@samsung.com> Signed-off-by: Douglas Anderson <dianders@chromium.org> Link: https://patch.msgid.link/20260406162231.v5.2.I54b3ae6311ff34ad30227659d91bb109911a4aea@changeid Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-04-26Input: stmfts - fix formatting issuesDmitry Torokhov
Fix a few formatting issues reported by checkpatch. Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-04-26Input: stmfts - add optional reset GPIO supportPetr Hodina
Add support for an optional "reset-gpios" property. If present, the driver drives the reset line high at probe time and releases it during power-on, after the regulators have been enabled. Signed-off-by: Petr Hodina <petr.hodina@protonmail.com> Co-developed-by: David Heidelberg <david@ixit.cz> Signed-off-by: David Heidelberg <david@ixit.cz> Link: https://patch.msgid.link/20260409-stmfts5-v4-8-64fe62027db5@ixit.cz Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-04-26dt-bindings: input: touchscreen: st,stmfts: Introduce reset GPIODavid Heidelberg
FTS has associated reset GPIO, document it. Signed-off-by: David Heidelberg <david@ixit.cz> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Link: https://patch.msgid.link/20260409-stmfts5-v4-7-64fe62027db5@ixit.cz Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-04-26Input: stmfts - use client to make future code cleanerPetr Hodina
Make code cleaner, compiler will optimize it away anyway. Preparation for FTM5 support, where more steps are needed. Signed-off-by: Petr Hodina <petr.hodina@protonmail.com> Signed-off-by: David Heidelberg <david@ixit.cz> Link: https://patch.msgid.link/20260409-stmfts5-v4-6-64fe62027db5@ixit.cz Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-04-26Input: stmfts - disable regulators and disable irq when power on failsDavid Heidelberg
We must power off regulators and ensure that IRQ is disabled when failing at power on phase. Create stmfts_configure function to limit use of goto. Signed-off-by: David Heidelberg <david@ixit.cz> Link: https://patch.msgid.link/20260409-stmfts5-v4-5-64fe62027db5@ixit.cz Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-04-26Input: stmfts - abstract reading information from the firmwareDavid Heidelberg
Improves readability and makes splitting power on function in following commit easier. Signed-off-by: David Heidelberg <david@ixit.cz> Link: https://patch.msgid.link/20260409-stmfts5-v4-4-64fe62027db5@ixit.cz Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-04-26Input: stmfts - switch to devm_regulator_bulk_get_constDavid Heidelberg
Switch to devm_regulator_bulk_get_const() to stop setting the supplies list in probe(), and move the regulator_bulk_data struct in static const. Signed-off-by: David Heidelberg <david@ixit.cz> Link: https://patch.msgid.link/20260409-stmfts5-v4-3-64fe62027db5@ixit.cz Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-04-26Input: stmfts - use dev struct directlyDavid Heidelberg
Makes the code better readable and noticably shorter. Signed-off-by: David Heidelberg <david@ixit.cz> Link: https://patch.msgid.link/20260409-stmfts5-v4-2-64fe62027db5@ixit.cz Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-04-26Input: stmfts - fix the MODULE_LICENSE() stringDavid Heidelberg
Replace the bogus "GPL v2" with "GPL" as MODULE_LICNSE() string. The value does not declare the module's exact license, but only lets the module loader test whether the module is Free Software or not. See commit bf7fbeeae6db ("module: Cure the MODULE_LICENSE "GPL" vs. "GPL v2" bogosity") in the details of the issue. The fix is to use "GPL" for all modules under any variant of the GPL. Signed-off-by: David Heidelberg <david@ixit.cz> Link: https://patch.msgid.link/20260409-stmfts5-v4-1-64fe62027db5@ixit.cz Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-04-26Linux 7.1-rc1v7.1-rc1Linus Torvalds
2026-04-26Merge tag 'clk-for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk fix from Stephen Boyd: "One more fix for the merge window to avoid a boot hang on Raspberry Pi 3B by marking the VEC clk critical so that it doesn't get turned off and hang the bus" * tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: clk: bcm: rpi: Mark VEC clock as CLK_IGNORE_UNUSED
2026-04-26Merge tag 'tsm-for-7.1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/devsec/tsm Pull PCIe TSP update from Dan Williams: "A small update for the TSM core. It is arguably a fix and coming in late as I have been offline the past few weeks: - Drop class_create() for the 'tsm' class" * tag 'tsm-for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/devsec/tsm: virt: coco: change tsm_class to a const struct
2026-04-26drm/hyperv: use VMBUS_RING_SIZE()Hamza Mahfooz
VMBUS ring buffers must be page aligned. So, use VMBUS_RING_SIZE() to ensure they are always aligned and large enough to hold all of the relevant data. Cc: stable@kernel.vger.org Fixes: 76c56a5affeb ("drm/hyperv: Add DRM driver for hyperv synthetic video device") Signed-off-by: Hamza Mahfooz <hamzamahfooz@linux.microsoft.com> Reviewed-by: Saurabh Sengar <ssengar@linux.microsoft.com> Link: https://patch.msgid.link/20260425181719.1538483-2-hamzamahfooz@linux.microsoft.com
2026-04-26drm/edid: add CTA Video Format Data Block supportHamza Mahfooz
Video Format Data Blocks (VFDBs) contain the necessary information that needs to be fed to the Optimized Video Timings (OVT) Algorithm. Also, we require OVT support to cover modes that aren't supported by earlier standards (e.g. CVT). So, parse all of the relevant VFDB data and feed it to the OVT Algorithm, to extract all of the missing OVT modes. Suggested-by: Karol Herbst <kherbst@redhat.com> Signed-off-by: Hamza Mahfooz <someguy@effective-light.com> Link: https://patch.msgid.link/20260225175709.408010-1-someguy@effective-light.com
2026-04-25Merge tag 'kbuild-fixes-7.1-1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux Pull Kbuild fixes from Nicolas Schier: - builddeb - avoid recompiles for non-cross-compiles Avoid triggering complete rebuilds for non-cross-compile Debian package builds by only triggering the rebuild of host tools for actual cross-compile builds - Never respect CONFIG_WERROR / W=e to fixdep Avoid spurious rebuilds of fixdep w/ and w/o -Werror during a single kbuild invocation by never respecting CONFIG_WERROR for fixdep * tag 'kbuild-fixes-7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux: kbuild: Never respect CONFIG_WERROR / W=e to fixdep kbuild: builddeb - avoid recompiles for non-cross-compiles
2026-04-25Merge tag 'power-utilities-2026.04.25' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux Pull power utility updates from Len Brown: "x86_energy_perf_policy: - Initial SoC Slider support turbostat: - Display HT siblings in cpu# order - Add Module-ID column - Print Core-ID and APIC-ID in hex - Fix misc bugs" * tag 'power-utilities-2026.04.25' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux: tools/power x86_energy_perf_policy: Version 2026.04.25 tools/power x86_energy_perf_policy.8: Document SoC Slider Options tools/power x86_energy_perf_policy: Enhances SoC Slider related checks tools/power turbostat: v2026.04.21 tools/power turbostat: Process HT siblings in CPU order tools/power turbostat: Show module_id column tools/power turbostat: Print core_id and apic_id in hex tools/power turbostat: Cleanup print helper functions tools/power turbostat: Fix --cpu-set 1 regression on HT systems tools/power turbostat: Fix --cpu-set 0 regression on HT systems tools/power turbostat: Fix unrecognized option '-P' tools/power turbostat: Fix AMD RAPL regression on big systems tools/power/x86: Add SOC slider and platform profile support
2026-04-25Merge tag 'rtc-7.1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux Pull RTC updates from Alexandre Belloni: "Subsystem: - add data_race() in rtc_dev_poll() Drivers: - remove i2c_match_id usage - abx80x: Disable alarm feature if no interrupt attached - ti-k3: support resuming from IO DDR low power mode" * tag 'rtc-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux: rtc: abx80x: Disable alarm feature if no interrupt attached rtc: ntxec: fix OF node reference imbalance rtc: pic32: allow driver to be compiled with COMPILE_TEST rtc: ti-k3: Add support to resume from IO DDR low power mode rtc: cmos: Use platform_get_irq_optional() in cmos_platform_probe() dt-bindings: rtc: add olpc,xo1-rtc to trivial-rtc dt-bindings: rtc: sc2731: Add compatible for SC2730 rtc: add data_race() in rtc_dev_poll() rtc: armada38x: zalloc + calloc to single allocation dt-bindings: rtc: isl12026: convert to YAML schema dt-bindings: rtc: microcrystal,rv3028: Allow to specify vdd-supply rtc: max77686: convert to i2c_new_ancillary_device dt-bindings: rtc: mpfs-rtc: permit resets rtc: rx8025: Remove use of i2c_match_id() rtc: rv8803: Remove use of i2c_match_id() rtc: rs5c372: Remove use of i2c_match_id() rtc: pcf2127: Remove use of i2c_match_id() rtc: m41t80: Remove use of i2c_match_id() rtc: abx80x: Remove use of i2c_match_id()
2026-04-25Merge tag 'for-next-tpm-7.1-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd Pull tpm updates from Jarkko Sakkinen: "Here are the accumulated fixes for 7.1-rc1 and a single structural change worth mentioning separately: Rafael's commit converting tpm_crb from ACPI driver to a platform driver" * tag 'for-next-tpm-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd: tpm: tpm_tis: stop transmit if retries are exhausted tpm: tpm_tis: add error logging for data transfer tpm: avoid -Wunused-but-set-variable tpm: Use kfree_sensitive() to free auth session in tpm_dev_release() tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public() tpm: Fix auth session leak in tpm2_get_random() error path tpm: i2c: atmel: fix block comment formatting tpm_crb: Convert ACPI driver to a platform one tpm: Make tcpci_pm_ops variable static const
2026-04-25Merge branches 'turbostat' and 'x86_energy_perf_policy' into power-utilitiesLen Brown
2026-04-25tools/power x86_energy_perf_policy: Version 2026.04.25Len Brown
Since v2025.11.22: Initial SoC Slider support SoC Slider is an SoC-wide power/performance policy setting. On SoC Slider systems, EPP plays a diminished role. Whitespace cleanup via: indent -npro -kr -i8 -ts8 -sob -l160 -ss -ncs -cp1 No functional changes Signed-off-by: Len Brown <len.brown@intel.com>
2026-04-25tools/power x86_energy_perf_policy.8: Document SoC Slider OptionsLen Brown
x86_energy_perf_policy accesses the SoC Slider via standard user/kernel APIs to the processor_thermal_soc_slider driver. Machines that support SoC Slider largely use it instead of EPP, which may continue to exist in a diminished role, or vanish entirely. Signed-off-by: Len Brown <len.brown@intel.com>
2026-04-25tools/power x86_energy_perf_policy: Enhances SoC Slider related checksLen Brown
When processor_thermal_soc_slider is loaded, its slider and offset modparams are visible. Check that the driver actually registered the profile named "SoC Slider" before reading or writing these modparams. n.b. This utility allows writing the Slider and Offset modparams even if the driver policy is not "balanced". Currently the processor_thermal_soc_slider consults those modparams only in "balanced" mode. Signed-off-by: Len Brown <len.brown@intel.com>
2026-04-25clk: bcm: rpi: Mark VEC clock as CLK_IGNORE_UNUSEDMaíra Canal
On Raspberry Pi 3B, the VEC clock is used by the VideoCore firmware display driver, which remains active until the vc4 driver loads and sends NOTIFY_DISPLAY_DONE. If this clock is disabled during boot, a bus lockup happens and the firmware becomes unresponsive, causing a complete system lockup. Mark the VEC clock with CLK_IGNORE_UNUSED so it survives the unused clock disablement and remains available until the vc4 driver takes over display management. Fixes: 672299736af6 ("clk: bcm: rpi: Manage clock rate in prepare/unprepare callbacks") Reported-by: Mark Brown <broonie@kernel.org> Closes: https://lore.kernel.org/r/5f0bec08-f458-4fba-8bf3-06817a100c4c@sirena.org.uk Signed-off-by: Maíra Canal <mcanal@igalia.com> Link: https://patch.msgid.link/20260401111416.562279-2-mcanal@igalia.com Tested-by: Mark Brown <broonie@kernel.org> Signed-off-by: Mark Brown <broonie@kernel.org> Acked-by: Brian Masney <bmasney@redhat.com> # Active contributor to clk Reviewed-by: Stefan Wahren <wahrenst@gmx.net> Signed-off-by: Stephen Boyd <sboyd@kernel.org>
2026-04-25Merge tag 'fbdev-for-7.1-rc1-2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev Pull fbdev fixes from Helge Deller: - request memory region before use (cobalt_lcdfb, clps711x-fb, hgafb) - reference cleanups in failure path (offb, savage) - a spelling fix (atyfb) * tag 'fbdev-for-7.1-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev: fbdev: hgafb: Request memory region before ioremap fbdev: clps711x-fb: Request memory region for MMIO fbdev: cobalt_lcdfb: Request memory region fbdev: atyfb: Fix spelling mistake "enfore" -> "enforce" fbdev: savage: fix probe-path EDID cleanup leaks fbdev: offb: fix PCI device reference leak on probe failure
2026-04-25Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linuxLinus Torvalds
Pull ARM updates from Russell King: - fix a race condition handling PG_dcache_clean - further cleanups for the fault handling, allowing RT to be enabled - fixing nzones validation in adfs filesystem driver - fix for module unwinding * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux: ARM: 9463/1: Allow to enable RT ARM: 9472/1: fix race condition on PG_dcache_clean in __sync_icache_dcache() ARM: 9471/1: module: fix unwind section relocation out of range error fs/adfs: validate nzones in adfs_validate_bblk() ARM: provide individual is_translation_fault() and is_permission_fault() ARM: move FSR fault status definitions before fsr_fs() ARM: use BIT() and GENMASK() for fault status register fields ARM: move is_permission_fault() and is_translation_fault() to fault.h ARM: move vmalloc() lazy-page table population ARM: ensure interrupts are enabled in __do_user_fault()
2026-04-24Merge branch 'bpf-replace-min-max-fields-with-struct-cnum-32-64'Alexei Starovoitov
Eduard Zingerman says: ==================== bpf: replace min/max fields with struct cnum{32,64} This RFC replaces s64, u64, s32, u32 scalar range domains tracked by verifier by a pair of circular numbers (cnums): one for 64-bit domain and another for 32-bit domain. Each cnum represents a range as a single arc on the circular number line, from which signed and unsigned bounds are derived on demand. See also wrapped intervals representation as in [1]. The use of such representation simplifies arithmetic and conditions handling in verifier.c and allows to express 32 <-> 64 bit deductions in a more mathematically rigorous way. [1] https://jorgenavas.github.io/papers/ACM-TOPLAS-wrapped.pdf Changelog ========= v2 -> v1: - Fixes in source code comments highlighted by bot+bpf-ci. RFCv1 -> v2: - Dropped RFC tag. - Dropped cnum{32,64}_mul(), too much complexity and no veristat or selftests gains. - cnum32_from_cnum64() normalizes to CNUM32_EMPTY when input cnum64.size >= U32_MAX, previously only checked for > U32_MAX (bot+bpf-ci). - cnum32_from_cnum64() and cnum64_cnum32_intersect() now check for empty inputs (sashiko). - In regs_refine_cond_op() case BPF_JSLT use cnum{32,64}_from_srange constructors instead of unsigned variants (sashiko). - cnum{32,64}_intersect_with{,_urange,_srange}() helpers added (Alexei) [RFCv1] https://lore.kernel.org/bpf/0c47b0b7ea476647746806c46fded4353be885f7.camel@gmail.com/T/ [v2] https://lore.kernel.org/bpf/c4fb60bafd526ae2d92b86e2250255aef0ba5ee1.camel@gmail.com/T/ Patch set layout ================ Patch #1 introduces the cnum (circular number) data type and basic operations: intersection, addition, multiplication, negation, 32-to-64 and 64-to-32 projections. CBMC based proofs for these operations are available at [2]. (The proofs lag behind the current patch set and need an update if this RFC moves further. Although, I don't expect any significant changes). [2] https://github.com/eddyz87/cnum-verif Patch #2 mechanically converts all direct accesses to bpf_reg_state's min/max fields to use accessor functions, preparing for the field replacement. Patch #3 replaces the eight independent min/max fields in bpf_reg_state with two cnum fields. The signed and unsigned bounds are derived on demand from the cnum via the accessor functions. This eliminates the separate signed<->unsigned cross-deduction logic, simplifies reg_bounds_sync(), regs_refine_cond_op() and some arithmetic operations. Patch #4 adds selftest cases for improved 32->64 range refinements enabled by cnum64_cnum32_intersect(). Precision trade-offs ==================== A cnum represents a contiguous arc on the circular number line. Current master tracks four independent ranges (s64, u64, s32, u32) whose intersection could implicitly represent value sets that are two disjoint arcs on the circle - something a single cnum cannot. Cnums lose precision when a cross-domain conditional comparison (e.g., unsigned comparison on a register with a signed-derived range) produces an intersection that would be two disjoint arcs. The cnum must over-approximate by returning one of the input arcs. E.g. a pair of ranges u64:[1,U64_MAX] s:[-1,1] represents a set of two values: {-1,1}, this can only be approximated as a set of three values by cnum: {-1,0,1}. Cnums gain precision in arithmetic: when addition, subtraction or multiplication causes register value to cross both signed and unsigned min/max boundaries. Current master resets the register as unbound in such cases, while cnums preserve the exact wrapping arc. In practice precision loss turned out to matter only for a set of specifically crafted selftests from reg_bounds.c (see patch #3 for more details). On the other hand, precision gains are observable for a set real-life programs. Verification performance measurements ===================================== Tested on 6683 programs across four corpora: Cilium (134 programs), selftests (4635), sched_ext (376), and Meta internal BPF corpus (1540). Program verification verdicts are identical across all four program sets - no program changes between success and failure. Instruction count comparison (cnum vs signed/unsigned pair): - 83 programs improve, 44 regress, 6596 unchanged - Total saved: ~290K insns, total added: 10K insns - Largest improvements: -26% insns in a internal network firewall program; -47% insns in rusty/wd40 sched_ext schedulers. - Largest regression: +24% insns in one Cilium program (5062 insns added). Raw performance data is at the bottom of the email. Raw verification performance metrics ==================================== Filtered out by -f insns_pct>5 -f !insns<10000 ========= selftests: master vs cnums-everywhere-v2 ========= File Program Insns (A) Insns (B) Insns (DIFF) ---- ------- --------- --------- ------------ Total progs: 4665 total_insns diff min: -15.71% total_insns diff max: 45.45% -20 .. -10 %: 3 -5 .. 0 %: 6 0 .. 5 %: 4654 45 .. 50 %: 2 ========= scx: master vs cnums-everywhere-v2 ========= File Program Insns (A) Insns (B) Insns (DIFF) --------------- -------------- --------- --------- ---------------- scx_rusty.bpf.o rusty_enqueue 39842 22053 -17789 (-44.65%) scx_rusty.bpf.o rusty_stopping 37738 19949 -17789 (-47.14%) scx_wd40.bpf.o wd40_stopping 37729 19880 -17849 (-47.31%) Total progs: 376 total_insns diff min: -47.31% total_insns diff max: 19.61% -50 .. -40 %: 3 -5 .. 0 %: 5 0 .. 5 %: 366 5 .. 15 %: 1 15 .. 20 %: 1 ========= meta: master vs cnums-everywhere-v2 ========= File Program Insns (A) Insns (B) Insns (DIFF) --------------------------------- ---------- --------- --------- ---------------- <meta-internal-firewall-program> ...egress 222327 164648 -57679 (-25.94%) <meta-internal-firewall-program> ..._tc_eg 222839 164772 -58067 (-26.06%) <meta-internal-firewall-program> ...egress 222327 164648 -57679 (-25.94%) <meta-internal-firewall-program> ..._tc_eg 222839 164772 -58067 (-26.06%) Total progs: 1540 total_insns diff min: -26.06% total_insns diff max: 6.69% -30 .. -20 %: 4 -15 .. -5 %: 6 -5 .. 0 %: 36 0 .. 5 %: 1493 5 .. 10 %: 1 ========= cilium: master vs cnums-everywhere-v2 ========= File Program Insns (A) Insns (B) Insns (DIFF) ---------- ------------------------------- --------- --------- --------------- bpf_host.o tail_handle_ipv4_cont_from_host 20962 26024 +5062 (+24.15%) bpf_host.o tail_handle_ipv6_cont_from_host 17036 18672 +1636 (+9.60%) Total progs: 134 total_insns diff min: -3.32% total_insns diff max: 24.15% -5 .. 0 %: 12 0 .. 5 %: 120 5 .. 15 %: 1 20 .. 25 %: 1 --- ==================== Link: https://patch.msgid.link/20260424-cnums-everywhere-rfc-v1-v3-0-ca434b39a486@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-24selftests/bpf: new cases handled by 32->64 range refinementsEduard Zingerman
1. 32-bit range starts before 64-bit range's low bits in each block, causing intersection to skip entire blocks. 2. 32-bit range crosses the U32_MAX/0 boundary, represented as s32 range crossing sign boundary. Signed-off-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/r/20260424-cnums-everywhere-rfc-v1-v3-4-ca434b39a486@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-24bpf: replace min/max fields with struct cnum{32,64}Eduard Zingerman
Replace eight independent s64, u64, s32, u32 min/max fields in bpf_reg_state with two circular number fields: - cnum64 for a unified signed/unsigned 64-bit range tracking; - cnum32 for a unified signed/unsigned 32-bit range tracking. Each cnum represents a range as a single arc on the circular number line (base + size), from which signed and unsigned bounds are derived on demand via accessor functions introduced in the preceding commit. Notable changes: - Signed<->unsigned deductions in __reg_deduce_bounds() are removed. - 64<->32 bit deductions are replaced with: - reg->r32 = cnum32_intersect(reg->r32, cnum32_from_cnum64(reg->r64)); this is functionally equivalent to the old code. - reg->r64 = cnum64_cnum32_intersect(reg->r64, reg->r32); this handles a few additional cases, see commit message for "bpf: representation and basic operations on circular numbers". - regs_refine_cond_op() now computes results in terms of operations on sets, e.g. for JNE: /* Complement of the range [val, val] as cnum64. */ lo = (struct cnum64){ val + 1, U64_MAX - 1 }; reg1->r64 = cnum64_intersect(reg1->r64, lo); - For add, sub operations on scalars replace explicit bounds computations with cnum{32,64}_{add,negate}. - For add, sub operations on pointers deduplicate with arithmetic operations on scalars and use cnum{32,64}_{add,negate}. - For and, or, xor operations on scalars remove explicit signed bounds computations. - range_bounds_violation() reduces to checking cnum_is_empty(). - const_tnum_range_mismatch() reduces to checking cnum_is_const(). Selftest adjustments: a few existing tests are updated because a single cnum arc cannot always represent what the old system expressed as the intersection of independent signed and unsigned ranges. For example, if the old system tracked u64=[0, U64_MAX-U32_MAX+2] and s64=[S64_MIN+2, 2] independently, their intersection is a tight two-point set. A single cnum must pick the shorter arc, losing the other constraint. These cases are documented with comments in the adjusted tests. reg_bounds.c is updated with logic similar to cnum64_cnum32_intersect(). Instead of using cnums it inspects intersection between 'b' and first / last / next-after-first / previous-before-last sub-ranges of 'a'. reg_bounds.c is also updated to skip test cases that rely in signed and unsigned ranges intersecting in two intervals, as such cases are not representable by a single cnum. The following "crafted" test cases are affected: - reg_bounds_crafted/(s64)[0xffffffffffff8000; 0x7fff] (u32)<op> [0; 0x1f] - reg_bounds_crafted/(s64)[0; 0x1f] (u32)<op> [0xffffffffffffff80; 0x7f] - reg_bounds_crafted/(s64)[0xffffffffffffff80; 0x7f] (u32)<op> [0; 0x1f] - reg_bounds_crafted/(u64)[0; 1] (s32)<op> [1; 2147483648] - reg_bounds_crafted/(u64)[1; 2147483648] (s32)<op> [0; 1] - reg_bounds_crafted/(u64)[0; 0xffffffff00000000] (s64)<op> 0 - reg_bounds_crafted/(u64)0 (s64)<op> [0; 0xffffffff00000000] - reg_bounds_crafted/(u64)[0; 0xffffffff00000000] (s32)<op> 0 - reg_bounds_crafted/(u64)0 (s32)<op> [0; 0xffffffff00000000] - reg_bounds_crafted/(s64)[S64_MIN; 0] (u64)<op> S64_MIN - reg_bounds_crafted/(s64)S64_MIN (u64)<op> [S64_MIN; 0] - reg_bounds_crafted/(s32)[S32_MIN; 0] (u32)<op> S32_MIN - reg_bounds_crafted/(s32)S32_MIN (u32)<op> [S32_MIN; 0] - reg_bounds_crafted/(s64)[0; 0x1f] (u32)<op> [0xffffffff80000000; 0x7fffffff] - reg_bounds_crafted/(s64)[0xffffffff80000000; 0x7fffffff] (u32)<op> [0; 0x1f] - reg_bounds_crafted/(s64)[0; 0x1f] (u32)<op> [0xffffffffffff8000; 0x7fff] As well as some reg_bounds_roand_{consts,ranges}_A_B, where A and B differ in sign domain. Signed-off-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/r/20260424-cnums-everywhere-rfc-v1-v3-3-ca434b39a486@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-24bpf: use accessor functions for bpf_reg_state min/max fieldsEduard Zingerman
Replace direct access to bpf_reg_state->{smin,smax,umin,umax, s32_min,s32_max,u32_min,u32_max}_value with getter/setter inline functions, preparing for future switch to cnum-based internal representation. Signed-off-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/r/20260424-cnums-everywhere-rfc-v1-v3-2-ca434b39a486@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-24bpf: representation and basic operations on circular numbersEduard Zingerman
This commit adds basic definitions for cnum32/cnum64. This is a unified numeric range representation for signed and unsigned domains. Inspired by an old post from Shung-Hsi Yu [1] and paper [2]. Operations correctness is verified using cbmc model checker, tests source code can be found in a separate repo [3]. The cnum64_cnum32_intersect() function is notable, because it handled several cases verifier.c:deduce_bounds_64_from_32() does not. Given: - a is a 64-bit range - b is a 32-bit range - t is a refined 64-bit range, such that ∀ v ∈ a, (u32)v ∈ b: v ∈ t. cnum64_cnum32_intersect() makes the following deductions: (A): 'b' is a sub-range of the first or the last 32-bit sub-range of 'a': 64-bit number axis ---> N*2^32 (N+1)*2^32 (N+2)*2^32 (N+3)*2^32 ||------|---|=====|-------||----------|=====|-------||----------|=====|----|--|| | |< b >| |< b >| |< b >| | | | | | |<--+--------------------------- a ---------------------------+--->| | | |<-------------------------- t -------------------------->| (B) 'b' does not intersect with the first of the last 32-bit sub-range of 'a': N*2^32 (N+1)*2^32 (N+2)*2^32 (N+3)*2^32 ||--|=====|----|----------||--|=====|---------------||--|=====|------------|--|| |< b >| | |< b >| |< b >| | | | | | |<-------------+--------- a -------------------|----------->| | | |<-------- t ------------------>| (C) 'b' crosses 0/U32_MAX boundary: N*2^32 (N+1)*2^32 (N+2)*2^32 (N+3)*2^32 ||===|---------|------|===||===|----------------|===||===|---------|------|===|| |b >| | |< b||b >| |< b||b >| | |< b| | | | | |<-----+----------------- a --------------+-------->| | | |<---------------- t ------------->| Current implementation of deduce_bounds_64_from_32() only handles case (A). [1] https://lore.kernel.org/all/ZTZxoDJJbX9mrQ9w@u94a/ [2] https://jorgenavas.github.io/papers/ACM-TOPLAS-wrapped.pdf [3] https://github.com/eddyz87/cnum-verif/tree/master Signed-off-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/r/20260424-cnums-everywhere-rfc-v1-v3-1-ca434b39a486@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-24Merge branch 'for-7.1-fixes' into for-7.2Tejun Heo
Pull to receive: c0e8ddc76d54 ("sched_ext: Align cgroup #ifdef guards with SUB_SCHED vs GROUP_SCHED") which conflicts with: 41e3312861ea ("sched_ext: add p->scx.tid and SCX_OPS_TID_TO_TASK lookup") It's a simple context conflict. Take changes from both. Signed-off-by: Tejun Heo <tj@kernel.org>
2026-04-24sched_ext: Release cpus_read_lock on scx_link_sched() failure in root enableTejun Heo
scx_root_enable_workfn() takes cpus_read_lock() before scx_link_sched(sch), but the `if (ret) goto err_disable` on failure skips the matching cpus_read_unlock() - all other err_disable gotos along this path drop the lock first. scx_link_sched() only returns non-zero on the sub-sched path (parent != NULL), so the leak path is unreachable via the root caller today. Still, the unwind is out of line with the surrounding paths. Drop cpus_read_lock() before goto err_disable. v2: Correct Fixes: tag (Andrea Righi). Fixes: 25037af712eb ("sched_ext: Add rhashtable lookup for sub-schedulers") Reported-by: Chris Mason <clm@meta.com> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-04-24sched_ext: Reject NULL-sch callers in scx_bpf_task_set_slice/dsq_vtimeTejun Heo
scx_prog_sched(aux) returns NULL for TRACING / SYSCALL BPF progs that have no struct_ops association when the root scheduler has sub_attach set. scx_bpf_task_set_slice() and scx_bpf_task_set_dsq_vtime() pass that NULL into scx_task_on_sched(sch, p), which under CONFIG_EXT_SUB_SCHED is rcu_access_pointer(p->scx.sched) == sch. For any non-scx task p->scx.sched is NULL, so NULL == NULL returns true and the authority gate is bypassed - a privileged but non-struct_ops-associated prog can poke p->scx.slice / p->scx.dsq_vtime on arbitrary tasks. Reject !sch up front so the gate only admits callers with a resolved scheduler. Fixes: 245d09c594ea ("sched_ext: Enforce scheduler ownership when updating slice and dsq_vtime") Reported-by: Chris Mason <clm@meta.com> Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-04-24sched_ext: Refuse cross-task select_cpu_from_kfunc callsTejun Heo
select_cpu_from_kfunc() skipped pi_lock for @p when called from ops.select_cpu() or another rq-locked SCX op, assuming the held lock protects @p. scx_bpf_select_cpu_dfl() / __scx_bpf_select_cpu_and() accept an arbitrary KF_RCU task_struct, so a caller in e.g. ops.select_cpu(p1) or ops.enqueue(p1) can pass some other p2 - the held pi_lock / rq lock is p1's, not p2's - and reading p2->cpus_ptr / nr_cpus_allowed races with set_cpus_allowed_ptr() and migrate_disable_switch() on another CPU. Abort the scheduler on cross-task calls in both branches: for ops.select_cpu() use scx_kf_arg_task_ok() to verify @p is the wake-up task recorded in current->scx.kf_tasks[] by SCX_CALL_OP_TASK_RET(); for other rq-locked SCX ops compare task_rq(p) against scx_locked_rq(). v2: Switch the in_select_cpu cross-task check from direct_dispatch_task comparison to scx_kf_arg_task_ok(). The former spuriously rejects when ops.select_cpu() calls scx_bpf_dsq_insert() first, then calls scx_bpf_select_cpu_*() on the same task. (Andrea Righi) Fixes: 0022b328504d ("sched_ext: Decouple kfunc unlocked-context check from kf_mask") Reported-by: Chris Mason <clm@meta.com> Signed-off-by: Tejun Heo <tj@kernel.org> Cc: Andrea Righi <arighi@nvidia.com>
2026-04-24sched_ext: Align cgroup #ifdef guards with SUB_SCHED vs GROUP_SCHEDTejun Heo
Two EXT_GROUP_SCHED/SUB_SCHED guards are misclassified: - scx_root_enable_workfn()'s cgroup_get(cgrp) and the err_put_cgrp unwind in scx_alloc_and_add_sched() are under `#if GROUP || SUB`, but the matching cgroup_put() in scx_sched_free_rcu_work() is inside `#ifdef SUB` only (via sch->cgrp, stored only under SUB). GROUP-only would leak a reference on every root-sched enable. - sch_cgroup() / set_cgroup_sched() live under `#if GROUP || SUB` but touch SUB-only fields (sch->cgrp, cgroup->scx_sched). GROUP-only wouldn't compile. GROUP needs CGROUP_SCHED; SUB needs only CGROUPS. CGROUPS=y/CGROUP_SCHED=n gives the reachable GROUP=n, SUB=y combination; GROUP=y, SUB=n isn't reachable today (SUB is def_bool y under CGROUPS). Neither miscategorization triggers a real bug in any reachable config, but keep the guards honest: - Narrow cgroup_get and err_put_cgrp to `#ifdef SUB` (matches the free-side put). - Move sch_cgroup() and set_cgroup_sched() to a separate `#ifdef SUB` block with no-op stubs for the !SUB case; keep root_cgroup() and scx_cgroup_{ lock,unlock}() under `#if GROUP || SUB` since those only need cgroup core. Fixes: ebeca1f930ea ("sched_ext: Introduce cgroup sub-sched support") Reported-by: Chris Mason <clm@meta.com> Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-04-24sched_ext: Make bypass LB cpumasks per-schedulerTejun Heo
scx_bypass_lb_{donee,resched}_cpumask were file-scope statics shared by all scheduler instances. With CONFIG_EXT_SUB_SCHED, multiple sched instances each arm their own bypass_lb_timer; concurrent bypass_lb_node() calls RMW the global cpumasks with no lock, corrupting donee/resched decisions. Move the cpumasks into struct scx_sched, allocate them alongside the timer in scx_alloc_and_add_sched(), free them in scx_sched_free_rcu_work(). Fixes: 95d1df610cdc ("sched_ext: Implement load balancer for bypass mode") Cc: stable@vger.kernel.org # v6.19+ Reported-by: Chris Mason <clm@meta.com> Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-04-24sched_ext: Pass held rq to SCX_CALL_OP() for core_sched_beforeTejun Heo
scx_prio_less() runs from core-sched's pick_next_task() path with rq locked but invokes ops.core_sched_before() with NULL locked_rq, leaving scx_locked_rq_state NULL. If the BPF callback calls a kfunc that re-acquires rq based on scx_locked_rq() - e.g. scx_bpf_cpuperf_set(cpu) - it re-acquires the already-held rq. Pass task_rq(a). Fixes: 7b0888b7cc19 ("sched_ext: Implement core-sched support") Cc: stable@vger.kernel.org # v6.12+ Reported-by: Chris Mason <clm@meta.com> Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-04-24sched_ext: Pass held rq to SCX_CALL_OP() for dump_cpu/dump_taskTejun Heo
scx_dump_state() walks CPUs with rq_lock_irqsave() held and invokes ops.dump_cpu / ops.dump_task with NULL locked_rq, leaving scx_locked_rq_state NULL. If the BPF callback calls a kfunc that re-acquires rq based on scx_locked_rq() - e.g. scx_bpf_cpuperf_set(cpu) - it re-acquires the already-held rq. Pass the held rq to SCX_CALL_OP(). Thread it into scx_dump_task() too. The pre-loop ops.dump call runs before rq_lock_irqsave() so keeps rq=NULL. Fixes: 07814a9439a3 ("sched_ext: Print debug dump after an error exit") Cc: stable@vger.kernel.org # v6.12+ Reported-by: Chris Mason <clm@meta.com> Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-04-24sched_ext: Save and restore scx_locked_rq across SCX_CALL_OPTejun Heo
SCX_CALL_OP{,_RET}() unconditionally clears scx_locked_rq_state to NULL on exit. Correct at the top level, but ops can recurse via scx_bpf_sub_dispatch(): a parent's ops.dispatch calls the helper, which invokes the child's ops.dispatch under another SCX_CALL_OP. When the inner call returns, the NULL clobbers the outer's state. The parent's BPF then calls kfuncs like scx_bpf_cpuperf_set() which read scx_locked_rq()==NULL and re-acquire the already-held rq. Snapshot scx_locked_rq_state on entry and restore on exit. Rename the rq parameter to locked_rq across all SCX_CALL_OP* macros so the snapshot local can be typed as 'struct rq *' without colliding with the parameter token in the expansion. SCX_CALL_OP_TASK{,_RET}() and SCX_CALL_OP_2TASKS_RET() funnel through the two base macros and inherit the fix. Fixes: 4f8b122848db ("sched_ext: Add basic building blocks for nested sub-scheduler dispatching") Reported-by: Chris Mason <clm@meta.com> Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-04-24sched_ext: Use dsq->first_task instead of list_empty() in dispatch_enqueue() ↵Tejun Heo
FIFO-tail dispatch_enqueue()'s FIFO-tail path used list_empty(&dsq->list) to decide whether to set dsq->first_task on enqueue. dsq->list can contain parked BPF iterator cursors (SCX_DSQ_LNODE_ITER_CURSOR), so list_empty() is not a reliable "no real task" check. If the last real task is unlinked while a cursor is parked, first_task becomes NULL; the next FIFO-tail enqueue then sees list_empty() == false and skips the first_task update, leaving scx_bpf_dsq_peek() returning NULL for a non-empty DSQ. Test dsq->first_task directly, which already tracks only real tasks and is maintained under dsq->lock. Fixes: 44f5c8ec5b9a ("sched_ext: Add lockless peek operation for DSQs") Cc: stable@vger.kernel.org # v6.19+ Reported-by: Chris Mason <clm@meta.com> Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Andrea Righi <arighi@nvidia.com> Cc: Ryan Newton <newton@meta.com>
2026-04-24sched_ext: Resolve caller's scheduler in scx_bpf_destroy_dsq() / ↵Tejun Heo
scx_bpf_dsq_nr_queued() scx_bpf_create_dsq() resolves the calling scheduler via scx_prog_sched(aux) and inserts the new DSQ into that scheduler's dsq_hash. Its inverse scx_bpf_destroy_dsq() and the query helper scx_bpf_dsq_nr_queued() were hard-coded to rcu_dereference(scx_root), so a sub-scheduler could only destroy or query DSQs in the root scheduler's hash - never its own. If the root had a DSQ with the same id, the sub-sched silently destroyed it and the root aborted on the next dispatch ("invalid DSQ ID 0x0.."). Take a const struct bpf_prog_aux *aux via KF_IMPLICIT_ARGS and resolve the scheduler with scx_prog_sched(aux), matching scx_bpf_create_dsq(). Fixes: ebeca1f930ea ("sched_ext: Introduce cgroup sub-sched support") Reported-by: Chris Mason <clm@meta.com> Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-04-24sched_ext: Read scx_root under scx_cgroup_ops_rwsem in cgroup settersTejun Heo
scx_group_set_{weight,idle,bandwidth}() cache scx_root before acquiring scx_cgroup_ops_rwsem, so the pointer can be stale by the time the op runs. If the loaded scheduler is disabled and freed (via RCU work) and another is enabled between the naked load and the rwsem acquire, the reader sees scx_cgroup_enabled=true (the new scheduler's) but dereferences the freed one - UAF on SCX_HAS_OP(sch, ...) / SCX_CALL_OP(sch, ...). scx_cgroup_enabled is toggled only under scx_cgroup_ops_rwsem write (scx_cgroup_{init,exit}), so reading scx_root inside the rwsem read section correlates @sch with the enabled snapshot. Fixes: a5bd6ba30b33 ("sched_ext: Use cgroup_lock/unlock() to synchronize against cgroup operations") Cc: stable@vger.kernel.org # v6.18+ Reported-by: Chris Mason <clm@meta.com> Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-04-24sched_ext: Don't disable tasks in scx_sub_enable_workfn() abort pathTejun Heo
scx_sub_enable_workfn()'s prep loop calls __scx_init_task(sch, p, false) without transitioning task state, then sets SCX_TASK_SUB_INIT. If prep fails partway, the abort path runs __scx_disable_and_exit_task(sch, p) on the marked tasks. Task state is still the parent's ENABLED, so that dispatches to the SCX_TASK_ENABLED arm and calls scx_disable_task(sch, p) - i.e. child->ops.disable() - for tasks on which child->ops.enable() never ran. A BPF sub-scheduler allocating per-task state in enable/freeing in disable would operate on uninitialized state. The dying-task branch in scx_disable_and_exit_task() has the same problem, and scx_enabling_sub_sched was cleared before the abort cleanup loop - a task exiting during cleanup tripped the WARN and skipped both ops.exit_task and the SCX_TASK_SUB_INIT clear, leaking per-task resources and leaving the task stuck. Introduce scx_sub_init_cancel_task() that calls ops.exit_task with cancelled=true - matching what the top-level init path does when init_task itself returns -errno. Use it in the abort loop and in the dying-task branch. scx_enabling_sub_sched now stays set until the abort loop finishes clearing SUB_INIT, so concurrent exits hitting the dying-task branch can still find @sch. That branch also clears SCX_TASK_SUB_INIT unconditionally when seen, leaving the task unmarked even if the WARN fires. Fixes: 337ec00b1d9c ("sched_ext: Implement cgroup sub-sched enabling and disabling") Reported-by: Chris Mason <clm@meta.com> Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Andrea Righi <arighi@nvidia.com>
generated by cgit v1.2.3 (git 2.25.1) at 2026-09-13 09:53:33 +0000