From nobody Tue Jun 16 04:06:20 2026 Received: from mail-pf1-f177.google.com (mail-pf1-f177.google.com [209.85.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1BDB537999D for ; Thu, 16 Apr 2026 06:14:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.177 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776320077; cv=none; b=XgK5LB0Y+pbWwzPgZUV6nPcQ3870vd3jNgwnwlPvFoUeoejHETQdGa4vh9V7j2TeZvynmNpEgrFvqcfrFolJqDMcd/aNc+LE1booX1PlC5H2yP/X4GPYeogbETfIeJQ5MVE3LiwAQU/wWQh/kXiWBITG4tx7MJ2aiKV4+IMEk3I= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776320077; c=relaxed/simple; bh=bIlSHN3p2C9CFdewLadyfrm4m++oDx1bXmdt6iBT0hw=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=n9HhXMX7JgAeBmrWvHUItBnZ/BSfiUq3oRsrhGiZfSiYKR4hQD7pWNAGyY82DmKtMi9iiEny55iHXkPDMR3gfYnEGx9OzxVvJB4RYF7JXLKTT6JKzHh3Ytlcok0YNvktEng9Z2zixjsZU2ljhDi+OsaeS1vwv1PN09PDxmHYfb0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=ALC77Qm4; arc=none smtp.client-ip=209.85.210.177 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="ALC77Qm4" Received: by mail-pf1-f177.google.com with SMTP id d2e1a72fcca58-82f7c7ee9b8so118169b3a.0 for ; Wed, 15 Apr 2026 23:14:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1776320075; x=1776924875; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=2iyrXZqmKnYYdkoP80E7Y3I8obAMb8t1aubrW7hBCic=; b=ALC77Qm4v7+8NbswTw/HICWiCHRplM2FnZDduD7RyVvXznJQXLlmCEUqFJ4yoKC/Dw Wp0R9JfIZqVUQD5XVHpPNdI8IKl5/TygymRMvpj9ay84BrWXjjTWHYALKQQ7wm7Z1a5i 8sgCZx9rfJBoNxJ47jhydsOKTj+cXo0/gaQaGEXU5Y+o+yk4J+ngl3MYxBdwkDvftZV2 1uKNuG0fN8WGhm8RK7xWClzE0mx8uZpDWGTYfSxIaPHqE/qmM1+Tfrg5TroqJwf+a5mX GB+Cfbks2H/R+cc7ZGoeNAmpylcs7HeYl70zIGJHLgyu7YRabjMFhU0li7NWdOWt6WFV aa6A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1776320075; x=1776924875; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=2iyrXZqmKnYYdkoP80E7Y3I8obAMb8t1aubrW7hBCic=; b=LFtxzZv35eFB6zQn1vkIRZ5DlI6AEmwvlLXc0CqfuND4ZsS51C+Nxo16QyMJNUuLyy Q4AbEenCgRS+WFoBMbqFzfUadspSipXCRq0vh3mvpllf4rwhcfdInqQETjB6+s9pehTK 8BZurGunh2FpDaCGS7APpvTIZDIqRtTABRM3+t1kDuqrWgMhgt5ZRH82hTg2qV3GbhnH 8tTFAnWo7a+xP0hdxosXPtSYvwkxLlf1O956FV9DU8sCNzLaVLO2pzTDHRXgBL9h8oY6 PC6/cANJSAuV1fz3eDKp7I4iq+ZbITG0B0jmIBTEA+5kReelQdm7G3tFMDMz1n3CewWM Cjbw== X-Forwarded-Encrypted: i=1; AFNElJ9T7UCGrWHZsHeZ16DqYmKD2dlgwcvd/+m5hqvvhIOlfD3/1oEjb80VXMKGvuzVD2dsOBOFrEKcYE88CVU=@vger.kernel.org X-Gm-Message-State: AOJu0YzLGFTUaJI/iH0+gHCZ00obFdXIitchexdQkgQTW9kh1b7OhO3/ eQA85xEaHEFcgmjndeASEwaHys6csVyCiKoTleWdnWCbApWpOjnqzn7O X-Gm-Gg: AeBDieswOSH3YDljBVssJTBU3CSkZjRZbxDBVcdJieAr3AbaJ8q4leyYyGVBYlOpqmC 4JR8rL7x9umDQ/Wrzvhky2MVLod5dv0X8rG1D8GFJcVnAOZsjXe/IeTlbHM349ODzWBl8lpZAqw MZo226r5Yryrd+eYRwJ/CzinfW5+1TxT6EIuujIAkmksMFu1EFiXQCBjiBK3IyW5wclPAx3JgWa FbFX5ZTTrxiTvg2/qZLYgQLYxq/3RB8xijgA09EP9vLTQM2tg7uj4tx86TWxpxzemV0UoaF7s0u y/L7qO+NLIXfzisJ6PnwyweapxwE6jncAjwHQdTl7PkJTRrnmEr+RaDqYoyPVE5ks6dGDgbnkT0 AUrHYc0gPJaW7TZdQJzXF+8OLBrD/AC6Rc+RwjSXYIrFU4YaYLJ4F7kCzagOAlxiaPzbpDn/Bbz SwHFja+Hop0BhO7wBfGempYnGMyhzkCRRe X-Received: by 2002:a05:6a00:3a10:b0:828:d9a1:c5f9 with SMTP id d2e1a72fcca58-82f0c221bd1mr25440999b3a.33.1776320075167; Wed, 15 Apr 2026 23:14:35 -0700 (PDT) Received: from xiao.mioffice.cn ([43.224.245.230]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-82f6c3f0072sm3454584b3a.56.2026.04.15.23.14.31 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 15 Apr 2026 23:14:34 -0700 (PDT) From: Xiang Gao To: Ingo Molnar , Peter Zijlstra , Juri Lelli , Vincent Guittot Cc: Dietmar Eggemann , Steven Rostedt , Ben Segall , Mel Gorman , Valentin Schneider , K Prateek Nayak , linux-kernel@vger.kernel.org, Xiang Gao Subject: [PATCH] sched/numa: fix division by zero in task_nr_scan_windows() and task_scan_min() Date: Thu, 16 Apr 2026 14:14:29 +0800 Message-Id: <20260416061429.723362-1-gxxa03070307@gmail.com> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Xiang Gao sysctl_numa_balancing_scan_size is exposed to userspace via debugfs as scan_size_mb with no lower-bound validation. Writing 0 triggers division-by-zero crashes in two places: task_nr_scan_windows(): nr_scan_pages =3D MB_TO_PAGES(0) =3D 0 rss =3D round_up(rss, 0) <- undefined return rss / 0 <- division by zero task_scan_min(): windows =3D MAX_SCAN_WINDOW / 0 <- division by zero The third call site in task_numa_work() already guards against this with an explicit "if (!pages) return;" check at line 3522, but these two functions lack the same protection. Fix by clamping scan_size to a minimum of 1 in both functions before using it as a divisor, consistent with the existing guard in task_numa_work(). Signed-off-by: Xiang Gao --- kernel/sched/fair.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 69361c63353a..32e146796bd5 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -1665,6 +1665,8 @@ static unsigned int task_nr_scan_windows(struct task_= struct *p) * on resident pages */ nr_scan_pages =3D MB_TO_PAGES(sysctl_numa_balancing_scan_size); + if (!nr_scan_pages) + nr_scan_pages =3D 1; rss =3D get_mm_rss(p->mm); if (!rss) rss =3D nr_scan_pages; @@ -1682,6 +1684,8 @@ static unsigned int task_scan_min(struct task_struct = *p) unsigned int scan, floor; unsigned int windows =3D 1; =20 + if (!scan_size) + scan_size =3D 1; if (scan_size < MAX_SCAN_WINDOW) windows =3D MAX_SCAN_WINDOW / scan_size; floor =3D 1000 / windows; --=20 2.34.1