From nobody Wed Feb 11 04:01:05 2026 Received: from SHSQR01.spreadtrum.com (unknown [222.66.158.135]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6F92F4CB2E for ; Mon, 22 Apr 2024 08:23:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=222.66.158.135 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1713774190; cv=none; b=OQVsNp5p4YRqUt1C7MHMcOGwyRHy/BIzDf1LZ7HLm69IR+jWCBfi1C5eRsDdjsr8Yr9jUksr5r2F556ww6oC6yO+6sQ9u48ynfxBDNXBFj0W6gNohchNS/z1jSTsajc6HP32yJzQu0DkOIiqaG7mElv2zkYmiGTI8d6CMvGm34Q= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1713774190; c=relaxed/simple; bh=fx9YuYE5tfNvbEhu+Kifp+zfFy5kCKUb/5dSgbVi/Bw=; h=From:To:CC:Subject:Date:Message-ID:MIME-Version:Content-Type; b=n4I1BxsjzY/Fw7nIJkpX+uDsPAGmPtcROJtjfWcSGTDvqzhXHHZQD/fGZDppJumzlAExPBoqbkqRJ7eaca2qPyuSgSdEDzv+0NNPi8YzrYt9OJds5e21gDfF++DF1Wk76FpkBCWM9zfOFQT7/1MmwrdwJ3b+zlsz1hv+g2NmwF4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=unisoc.com; spf=pass smtp.mailfrom=unisoc.com; arc=none smtp.client-ip=222.66.158.135 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=unisoc.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=unisoc.com Received: from dlp.unisoc.com ([10.29.3.86]) by SHSQR01.spreadtrum.com with ESMTP id 43M8MmmN085755; Mon, 22 Apr 2024 16:22:48 +0800 (+08) (envelope-from Xuewen.Yan@unisoc.com) Received: from SHDLP.spreadtrum.com (bjmbx01.spreadtrum.com [10.0.64.7]) by dlp.unisoc.com (SkyGuard) with ESMTPS id 4VNJ8b0qwzz2MxHx5; Mon, 22 Apr 2024 16:20:15 +0800 (CST) Received: from BJ10918NBW01.spreadtrum.com (10.0.73.73) by BJMBX01.spreadtrum.com (10.0.64.7) with Microsoft SMTP Server (TLS) id 15.0.1497.23; Mon, 22 Apr 2024 16:22:42 +0800 From: Xuewen Yan To: , , , CC: , , , , , , , , , , Subject: [PATCH v2] sched/eevdf: Prevent vlag from going out of bounds when reweight_eevdf Date: Mon, 22 Apr 2024 16:22:38 +0800 Message-ID: <20240422082238.5784-1-xuewen.yan@unisoc.com> X-Mailer: git-send-email 2.25.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: SHCAS03.spreadtrum.com (10.0.1.207) To BJMBX01.spreadtrum.com (10.0.64.7) X-MAIL: SHSQR01.spreadtrum.com 43M8MmmN085755 Content-Type: text/plain; charset="utf-8" kernel encounters the following error when running workload: BUG: kernel NULL pointer dereference, address: 0000002c EIP: set_next_entity (fair.c:?) which was caused by NULL pointer returned by pick_eevdf(). Further investigation has shown that, the entity_eligible() has an false-negative issue when the entity's vruntime is far behind the cfs_rq.min_vruntime that, the (vruntime - cfs_rq->min_vruntime) * load caused a s64 overflow, thus every entity on the rb-tree is not eligible, which results in a NULL candidate. The reason why entity's vruntime is far behind the cfs_rq.min_vruntime is because during a on_rq task group's update_cfs_group()->reweight_eevdf(), there is no limit on the new entity's vlag. If the new weight is much smaller than the old one, vlag =3D div_s64(vlag * old_weight, weight) generates a huge vlag, and results in very small(negative) vruntime. Thus limit the range of vlag accordingly. Reported-by: Sergei Trofimovich Closes: https://lore.kernel.org/all/ZhuYyrh3mweP_Kd8@nz.home/ Reported-by: Igor Raits Closes: https://lore.kernel.org/all/CA+9S74ih+45M_2TPUY_mPPVDhNvyYfy1J1ftSi= x+KjiTVxg8nw@mail.gmail.com/ Reported-by: Breno Leitao Reported-by: kernel test robot Closes: https://lore.kernel.org/lkml/202401301012.2ed95df0-oliver.sang@inte= l.com/ Reported-by: Yujie Liu Signed-off-by: Xuewen Yan Tested-by: Yujie Liu --- changes of v2: -add reported-by (suggested by ) -remork the changelog () -remove the judgement of fork (Peter) -remove the !on_rq case. (Peter) --- Previous discussion link: https://lore.kernel.org/lkml/20240226082349.302363-1-yu.c.chen@intel.com/ https://lore.kernel.org/all/20240130080643.1828-1-xuewen.yan@unisoc.com/ --- --- kernel/sched/fair.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 03be0d1330a6..64826f406d6d 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -696,15 +696,21 @@ u64 avg_vruntime(struct cfs_rq *cfs_rq) * * XXX could add max_slice to the augmented data to track this. */ -static void update_entity_lag(struct cfs_rq *cfs_rq, struct sched_entity *= se) +static s64 entity_lag(u64 avruntime, struct sched_entity *se) { - s64 lag, limit; + s64 vlag, limit; + + vlag =3D avruntime - se->vruntime; + limit =3D calc_delta_fair(max_t(u64, 2*se->slice, TICK_NSEC), se); + + return clamp(vlag, -limit, limit); +} =20 +static void update_entity_lag(struct cfs_rq *cfs_rq, struct sched_entity *= se) +{ SCHED_WARN_ON(!se->on_rq); - lag =3D avg_vruntime(cfs_rq) - se->vruntime; =20 - limit =3D calc_delta_fair(max_t(u64, 2*se->slice, TICK_NSEC), se); - se->vlag =3D clamp(lag, -limit, limit); + se->vlag =3D entity_lag(avg_vruntime(cfs_rq), se); } =20 /* @@ -3761,7 +3767,7 @@ static void reweight_eevdf(struct cfs_rq *cfs_rq, str= uct sched_entity *se, * =3D V - vl' */ if (avruntime !=3D se->vruntime) { - vlag =3D (s64)(avruntime - se->vruntime); + vlag =3D entity_lag(avruntime, se); vlag =3D div_s64(vlag * old_weight, weight); se->vruntime =3D avruntime - vlag; } --=20 2.25.1