From nobody Sat Jul 25 20:06:04 2026 Received: from outbound.baidu.com (mx20.baidu.com [111.202.115.85]) by smtp.subspace.kernel.org (Postfix) with SMTP id 5540813D503 for ; Tue, 14 Jul 2026 05:31:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=111.202.115.85 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784007074; cv=none; b=p8RViA/c9k7HzbUAxPbz4m00Q+FQ6tbtDnSkyJ08XwkDkr7WZgYZk2SIK5D8SR9Tw1mYUB1CYDon6QNDrHJQa1qnQaeMlnAbLqPazl+24vUospAKi8ZEo9bjjmjHFg4GaO6HMkf73/3gi/DrFdvJDfjduOcm1muGhFVOgg9g87g= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784007074; c=relaxed/simple; bh=fiCWJXYVD/6CT97+1bduZJzcwHJR1u98doLtcMUEP6s=; h=From:To:CC:Subject:Date:Message-ID:MIME-Version:Content-Type; b=V5SaOhIkXfWxk3kVnpNBkU4AhltTtX4cMszG1XdB7ijMGVjOpih/aT9Us7pwDJa8mSnO5vmRYJdOUZlLOeDLSbzDkVKiafmxHQPY2anvxofCNACodgvlv5dHZJkS6GFKr5NKzbmEKbJC9njgE2E7c8yH+Wv87PLJpz43au5mZ8c= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=baidu.com; spf=pass smtp.mailfrom=baidu.com; dkim=pass (2048-bit key) header.d=baidu.com header.i=@baidu.com header.b=enrki4KH; arc=none smtp.client-ip=111.202.115.85 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=baidu.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=baidu.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=baidu.com header.i=@baidu.com header.b="enrki4KH" X-MD-Sfrom: lirongqing@baidu.com X-MD-SrcIP: 172.31.50.47 From: lirongqing To: Ingo Molnar , Peter Zijlstra , Juri Lelli , Vincent Guittot , Dietmar Eggemann , Steven Rostedt , Ben Segall , Mel Gorman , Valentin Schneider , K Prateek Nayak , CC: Li RongQing Subject: [PATCH] sched/debug: reject zero writes to numa_balancing scan_size_mb Date: Tue, 14 Jul 2026 13:30:45 +0800 Message-ID: <20260714053045.2177-1-lirongqing@baidu.com> X-Mailer: git-send-email 2.17.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-ClientProxiedBy: bjhj-exc4.internal.baidu.com (172.31.3.14) To bjkjy-exc3.internal.baidu.com (172.31.50.47) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=baidu.com; s=selector1; t=1784007056; bh=qpch8lstu0rXWU8hFM9iMdO/rk7L9NMUvWfy6TUG9b4=; h=From:To:CC:Subject:Date:Message-ID:Content-Type; b=enrki4KH61kvJJZu3WFJH086nW/t9Sj/6ff2EnI2fZsr3KBsAVTzNB3tankq5bFE/ eNt8nfBEN/6xTzX3u80p4doS+irMkrq2nGibr6tUe+RIVptq+hyUGcoLZT+CIR6C2I wldDYo0KLymIAjCGANzJgmAdodp3hWrjD1eOwO7xb7MI/ugYzdvBwD9kxW6hpVH09Q UlECufTWz+jc11NQxcMZB5Dtv/PLg3y6gTnp+lCiwaXlo93JYJDQfd9os5GQ/xKZZx sXpx+Cu3rpjWVOqwXlUdVJoCwGTaP/Iqbk7SItqqoM3X+8d0PdhEKvkyXHZG7v4BLD 8XZZyAKBe7ZLA== Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Li RongQing sysctl_numa_balancing_scan_size was registered via debugfs_create_u32(), which accepts any u32 value including 0. A zero value triggers divide-by-zero in two paths: task_scan_min(): windows =3D MAX_SCAN_WINDOW / scan_size; task_nr_scan_windows(): rss =3D round_up(rss, nr_scan_pages); /* undefined behavior */ return rss / nr_scan_pages; Replace the bare debugfs_create_u32() registration with a custom file_operations handler that rejects writes of 0 with -EINVAL, preventing the invalid value from ever being stored. Fixes: 8a99b6833c88 ("sched: Move SCHED_DEBUG sysctl to debugfs") Signed-off-by: Li RongQing --- kernel/sched/debug.c | 23 ++++++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-) diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c index 40584b2..3169a0d 100644 --- a/kernel/sched/debug.c +++ b/kernel/sched/debug.c @@ -633,6 +633,26 @@ static void debugfs_fair_server_init(void) } } =20 +#ifdef CONFIG_NUMA_BALANCING +static int numa_scan_size_get(void *data, u64 *val) +{ + *val =3D *(u32 *)data; + return 0; +} + +static int numa_scan_size_set(void *data, u64 val) +{ + if (val =3D=3D 0 || val > UINT_MAX) + return -ERANGE; + + *(u32 *)data =3D (u32)val; + return 0; +} + +DEFINE_DEBUGFS_ATTRIBUTE(numa_scan_size_fops, numa_scan_size_get, + numa_scan_size_set, "%llu\n"); +#endif /* CONFIG_NUMA_BALANCING */ + static __init int sched_init_debug(void) { struct dentry __maybe_unused *numa, *llc; @@ -664,7 +684,8 @@ static __init int sched_init_debug(void) debugfs_create_u32("scan_delay_ms", 0644, numa, &sysctl_numa_balancing_sc= an_delay); debugfs_create_u32("scan_period_min_ms", 0644, numa, &sysctl_numa_balanci= ng_scan_period_min); debugfs_create_u32("scan_period_max_ms", 0644, numa, &sysctl_numa_balanci= ng_scan_period_max); - debugfs_create_u32("scan_size_mb", 0644, numa, &sysctl_numa_balancing_sca= n_size); + debugfs_create_file("scan_size_mb", 0644, numa, + &sysctl_numa_balancing_scan_size, &numa_scan_size_fops); debugfs_create_u32("hot_threshold_ms", 0644, numa, &sysctl_numa_balancing= _hot_threshold); #endif /* CONFIG_NUMA_BALANCING */ =20 --=20 2.9.4