From nobody Mon May 25 00:09:52 2026 Received: from galois.linutronix.de (Galois.linutronix.de [193.142.43.55]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E87A03D8900; Wed, 20 May 2026 08:34:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=193.142.43.55 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779266074; cv=none; b=rX0flFbptL0aPO1kUzp/AACHRaQM+i+o8AwueNpDbVe5GPZqUOVLQWdzg31J2W/xIeqrZa31VV6ieSiqmjkC0KeCNVhYvDFyi7bP7gVMrOzz+dnIJz6LApMnvJXGQcrujUoulwhHVEcxlOzglhQnQLebBR+k2pREjNiAFiusrbc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779266074; c=relaxed/simple; bh=ijK034Fl9ja0sIDUNQXE0tZ6tXnIbk6RCBCLZKs1tE8=; h=Date:From:To:Subject:Cc:In-Reply-To:References:MIME-Version: Message-ID:Content-Type; b=t57FtK8wM3CsHe3eD2XpHAQ/voVAXhmX+jHhogW7Lopb1YPfWP6lcY90MoWIwxS4giOXgzNmu3y5FL3rqOfcultpkQw4EvRcmKqv0cgphKz2dCJdS1ThUDDwVo9cXVvtwTGDhE9p3AH65phqlPVF48poK7mEuo1F53UjLeWwe0M= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linutronix.de; spf=pass smtp.mailfrom=linutronix.de; dkim=pass (2048-bit key) header.d=linutronix.de header.i=@linutronix.de header.b=hekKWwJm; dkim=permerror (0-bit key) header.d=linutronix.de header.i=@linutronix.de header.b=ofl3wMXe; arc=none smtp.client-ip=193.142.43.55 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linutronix.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linutronix.de Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=linutronix.de header.i=@linutronix.de header.b="hekKWwJm"; dkim=permerror (0-bit key) header.d=linutronix.de header.i=@linutronix.de header.b="ofl3wMXe" Date: Wed, 20 May 2026 08:34:30 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1779266071; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Wc0KyaaoTw6ujqn/7aYLxdeCNbU7pDyzq0jUdXs8+CY=; b=hekKWwJmtKgSS91g0X+M/dP5yFtuJ143nyXwmvCPC2W3KmQuwhsWKwcfH2u5KG+DApVYzC +rbNRP2tcO9AFFvI3SKWgrnJeoTfF7yJaQCi/hViCnxV6wbhRnsOKzu34WarAcAVRpMj+j W4wnypdwumIUdeKaMhl5GQWkWf00r2g9+gr8YJL2m4wVXllnYzou16ec3E644FJxFb76ME 4c87ge+uHKTyDtE9scm3OU3azmuJ6i/CzX3ClP6PRPM04pQ0mWM7Ss/oBwviuPIEmwZPlw v7uXFkwerbc2c48+BLYDLnxq5hEo2J4AmHHaUr8Pm9XuLSFRvk7MxxK0MpeE2A== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1779266071; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Wc0KyaaoTw6ujqn/7aYLxdeCNbU7pDyzq0jUdXs8+CY=; b=ofl3wMXeKspsfTAlJA947BRRG2/HtLGJ/W+mIxKWtHp0SFz8la6maBxgLao1EiOhSm0C8m VF75ZgDt1K1DMIAA== From: "tip-bot2 for Chen Yu" Sender: tip-bot2@linutronix.de Reply-to: linux-kernel@vger.kernel.org To: linux-tip-commits@vger.kernel.org Subject: [tip: sched/core] sched/cache: Annotate lockless accesses to mm->sc_stat.cpu Cc: Chen Yu , Tim Chen , "Peter Zijlstra (Intel)" , x86@kernel.org, linux-kernel@vger.kernel.org In-Reply-To: =?utf-8?q?=3C63ea494f12efcf265d7134400a06cd75d7f2c310=2E1778703?= =?utf-8?q?694=2Egit=2Etim=2Ec=2Echen=40linux=2Eintel=2Ecom=3E?= References: =?utf-8?q?=3C63ea494f12efcf265d7134400a06cd75d7f2c310=2E17787036?= =?utf-8?q?94=2Egit=2Etim=2Ec=2Echen=40linux=2Eintel=2Ecom=3E?= Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Message-ID: <177926607008.711.5122182340022978787.tip-bot2@tip-bot2> Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails Precedence: bulk Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable The following commit has been merged into the sched/core branch of tip: Commit-ID: 91d07324c9305c0e4afff0cc859cac96594daa88 Gitweb: https://git.kernel.org/tip/91d07324c9305c0e4afff0cc859cac965= 94daa88 Author: Chen Yu AuthorDate: Wed, 13 May 2026 13:39:20 -07:00 Committer: Peter Zijlstra CommitterDate: Mon, 18 May 2026 21:33:16 +02:00 sched/cache: Annotate lockless accesses to mm->sc_stat.cpu mm->sc_stat.cpu is written by task_cache_work() and could be read locklessly by several functions on other CPUs. Use READ_ONCE and WRITE_ONCE on mm->sc_stat.cpu access and write to prevent inconsistent values from compiler optimizations when there are multiple accesses. For example in get_pref_llc(), if the writer updated the field between two compiler-generated loads, the validation (e.g., cpu !=3D -1) and subsequent use (e.g., llc_id(cpu)) could operate on different values, allowing a negative CPU ID to be used as an index. Leave plain write in mm_init_sched(), where the mm is not yet visible to other CPUs. This bug was reported by sashiko. Fixes: 47d8696b95f7 ("sched/cache: Assign preferred LLC ID to processes") Signed-off-by: Chen Yu Co-developed-by: Tim Chen Signed-off-by: Tim Chen Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/63ea494f12efcf265d7134400a06cd75d7f2c310.177= 8703694.git.tim.c.chen@linux.intel.com --- kernel/sched/fair.c | 29 +++++++++++++++-------------- 1 file changed, 15 insertions(+), 14 deletions(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 663968b..087445e 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -1598,13 +1598,14 @@ static unsigned long fraction_mm_sched(struct rq *r= q, =20 static int get_pref_llc(struct task_struct *p, struct mm_struct *mm) { - int mm_sched_llc =3D -1; + int mm_sched_llc =3D -1, mm_sched_cpu; =20 if (!mm) return -1; =20 - if (mm->sc_stat.cpu !=3D -1) { - mm_sched_llc =3D llc_id(mm->sc_stat.cpu); + mm_sched_cpu =3D READ_ONCE(mm->sc_stat.cpu); + if (mm_sched_cpu !=3D -1) { + mm_sched_llc =3D llc_id(mm_sched_cpu); =20 #ifdef CONFIG_NUMA_BALANCING /* @@ -1619,7 +1620,7 @@ static int get_pref_llc(struct task_struct *p, struct= mm_struct *mm) */ if (static_branch_likely(&sched_numa_balancing) && p->numa_preferred_nid >=3D 0 && - cpu_to_node(mm->sc_stat.cpu) !=3D p->numa_preferred_nid) + cpu_to_node(mm_sched_cpu) !=3D p->numa_preferred_nid) mm_sched_llc =3D -1; #endif } @@ -1665,8 +1666,8 @@ void account_mm_sched(struct rq *rq, struct task_stru= ct *p, s64 delta_exec) if ((long)(epoch - READ_ONCE(mm->sc_stat.epoch)) > llc_epoch_affinity_tim= eout || invalid_llc_nr(mm, p, cpu_of(rq)) || exceed_llc_capacity(mm, cpu_of(rq))) { - if (mm->sc_stat.cpu !=3D -1) - mm->sc_stat.cpu =3D -1; + if (READ_ONCE(mm->sc_stat.cpu) !=3D -1) + WRITE_ONCE(mm->sc_stat.cpu, -1); } =20 mm_sched_llc =3D get_pref_llc(p, mm); @@ -1714,7 +1715,7 @@ static void get_scan_cpumasks(cpumask_var_t cpus, str= uct task_struct *p) if (!static_branch_likely(&sched_numa_balancing)) goto out; =20 - cpu =3D p->mm->sc_stat.cpu; + cpu =3D READ_ONCE(p->mm->sc_stat.cpu); if (cpu !=3D -1) nid =3D cpu_to_node(cpu); curr_cpu =3D task_cpu(p); @@ -1799,8 +1800,8 @@ static void task_cache_work(struct callback_head *wor= k) curr_cpu =3D task_cpu(p); if (invalid_llc_nr(mm, p, curr_cpu) || exceed_llc_capacity(mm, curr_cpu)) { - if (mm->sc_stat.cpu !=3D -1) - mm->sc_stat.cpu =3D -1; + if (READ_ONCE(mm->sc_stat.cpu) !=3D -1) + WRITE_ONCE(mm->sc_stat.cpu, -1); =20 return; } @@ -1857,7 +1858,7 @@ static void task_cache_work(struct callback_head *wor= k) m_a_cpu =3D m_cpu; } =20 - if (llc_id(cpu) =3D=3D llc_id(mm->sc_stat.cpu)) + if (llc_id(cpu) =3D=3D llc_id(READ_ONCE(mm->sc_stat.cpu))) curr_m_a_occ =3D a_occ; =20 cpumask_andnot(cpus, cpus, sched_domain_span(sd)); @@ -1875,7 +1876,7 @@ static void task_cache_work(struct callback_head *wor= k) * 3. 2X is chosen based on test results, as it delivers * the optimal performance gain so far. */ - mm->sc_stat.cpu =3D m_a_cpu; + WRITE_ONCE(mm->sc_stat.cpu, m_a_cpu); } =20 update_avg_scale(&mm->sc_stat.nr_running_avg, nr_running); @@ -10441,15 +10442,15 @@ static enum llc_mig can_migrate_llc_task(int src_= cpu, int dst_cpu, if (!mm) return mig_unrestricted; =20 - cpu =3D mm->sc_stat.cpu; + cpu =3D READ_ONCE(mm->sc_stat.cpu); if (cpu < 0 || cpus_share_cache(src_cpu, dst_cpu)) return mig_unrestricted; =20 /* skip cache aware load balance for too many threads */ if (invalid_llc_nr(mm, p, dst_cpu) || exceed_llc_capacity(mm, dst_cpu)) { - if (mm->sc_stat.cpu !=3D -1) - mm->sc_stat.cpu =3D -1; + if (READ_ONCE(mm->sc_stat.cpu) !=3D -1) + WRITE_ONCE(mm->sc_stat.cpu, -1); return mig_unrestricted; } =20