From nobody Fri Jul 24 21:53:09 2026 Received: from outbound.baidu.com (mx13.baidu.com [220.181.3.100]) by smtp.subspace.kernel.org (Postfix) with SMTP id CEA213E314F for ; Thu, 23 Jul 2026 08:22:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=220.181.3.100 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784794935; cv=none; b=bigvDch+5c9LVUPVrqsQ7LSAZh5IZZShGw58Nya7xrC47OBHORChK79FahaK5BHshTIVEbZmnwbBn1Ne0ayzwkmQGg6Hvm50jQn0R1MKDson+jiCv+qDQhcagLcGDMc8cEq4+djAdYuUULlbcrDVhgzRUD8TRU43I2DU+0fLXoU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784794935; c=relaxed/simple; bh=ocD7SltyTgHBhhC0eg2MPeTG7QKLXuvKN3OaVn20cvo=; h=From:To:CC:Subject:Date:Message-ID:MIME-Version:Content-Type; b=n0rKFy98qCgvoQZpdEwkDXA1oLC5QAfUKrzYDftpjhxF2B+6I98Yo1l4Qib6K02TncTS/ppXJ+Jzoux19drgo9hrMhqGUXSjabC0EIcQjkORkv57WkxUaIxQb2OoCsMUB72n+9I4pC9GEolH6e+jBI7/V372upIh2UE4H9a5fkc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=baidu.com; spf=pass smtp.mailfrom=baidu.com; dkim=pass (2048-bit key) header.d=baidu.com header.i=@baidu.com header.b=gesG6AfH; arc=none smtp.client-ip=220.181.3.100 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=baidu.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=baidu.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=baidu.com header.i=@baidu.com header.b="gesG6AfH" X-MD-Sfrom: lirongqing@baidu.com X-MD-SrcIP: 172.31.50.47 From: lirongqing To: Ingo Molnar , Peter Zijlstra , Juri Lelli , Vincent Guittot , Dietmar Eggemann , Steven Rostedt , Ben Segall , Mel Gorman , Valentin Schneider , K Prateek Nayak , , Zhan Xusheng CC: Li RongQing Subject: [PATCH v2] sched/debug: reject invalid writes to numa_balancing scan_size_mb Date: Thu, 23 Jul 2026 16:21:44 +0800 Message-ID: <20260723082144.2190-1-lirongqing@baidu.com> X-Mailer: git-send-email 2.17.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-ClientProxiedBy: bjkjy-exc5.internal.baidu.com (172.31.50.49) To bjkjy-exc3.internal.baidu.com (172.31.50.47) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=baidu.com; s=selector1; t=1784794916; bh=Nb9SMPKv8TWiufUeMBcGRENV0NTUPVMu4DWsI4MpcnM=; h=From:To:CC:Subject:Date:Message-ID:Content-Type; b=gesG6AfHx7BBaTHZ5O/bfKaoVObO3STBC1d+DBVkP0JQb90mu/9Yg5WF3pIEZLQZE g73r68rIZPIPtB5UBU0pjSj53FqSelngK8tzYX5vr6i8Ds3CM/o32eY52CoaDLvG+x 1BoNlXF2SYKe5CXiAM+c+f7CrthNneODyw0ISmpvuQgUyLtkEzpb+9WdTHPT+s91ab KcyJSzU3XWpSJNjoMtoRXF1yT96Xaa6yP5Pw3B6hxwdEBrWJKfUJVBAwpjpq8ylF46 r9zbxS7FYpXZrJV7UNaFYI5g2tftoiQnvTgn/zZUKwd9i13xnH4GK2nQcJWGk4dHwY CviH4X4lQUDIw== Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Li RongQing The sysctl_numa_balancing_scan_size parameter is currently registered via debugfs_create_u32(), which accepts any u32 value including 0. A zero value triggers division-by-zero in two code paths: task_scan_min(): windows =3D MAX_SCAN_WINDOW / scan_size; task_nr_scan_windows(): rss =3D round_up(rss, nr_scan_pages); return rss / nr_scan_pages; Similarly, values exceeding UINT_MAX would be silently truncated by the write path before reaching this handler, potentially accepting unintended values. Reject them explicitly with -ERANGE Replace the debugfs_create_u32() interface with a custom file_operations handler that validates writes: reject 0 and values exceeding UINT_MAX with -ERANGE. Since the ops use DEFINE_DEBUGFS_ATTRIBUTE() which already provides removal protection via debugfs_file_get()/put(), debugfs_create_file_unsafe() is used instead of debugfs_create_file() to avoid an unnecessary full_proxy layer. Fixes: 8a99b6833c88 ("sched: Move SCHED_DEBUG sysctl to debugfs") Signed-off-by: Li RongQing --- Diff with v1: replace debugfs_create_file with debugfs_create_file_unsafe; and rewrite commit message kernel/sched/debug.c | 23 ++++++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-) diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c index 40584b2..391a669 100644 --- a/kernel/sched/debug.c +++ b/kernel/sched/debug.c @@ -633,6 +633,26 @@ static void debugfs_fair_server_init(void) } } =20 +#ifdef CONFIG_NUMA_BALANCING +static int numa_scan_size_get(void *data, u64 *val) +{ + *val =3D *(u32 *)data; + return 0; +} + +static int numa_scan_size_set(void *data, u64 val) +{ + if (val =3D=3D 0 || val > UINT_MAX) + return -ERANGE; + + *(u32 *)data =3D (u32)val; + return 0; +} + +DEFINE_DEBUGFS_ATTRIBUTE(numa_scan_size_fops, numa_scan_size_get, + numa_scan_size_set, "%llu\n"); +#endif /* CONFIG_NUMA_BALANCING */ + static __init int sched_init_debug(void) { struct dentry __maybe_unused *numa, *llc; @@ -664,7 +684,8 @@ static __init int sched_init_debug(void) debugfs_create_u32("scan_delay_ms", 0644, numa, &sysctl_numa_balancing_sc= an_delay); debugfs_create_u32("scan_period_min_ms", 0644, numa, &sysctl_numa_balanci= ng_scan_period_min); debugfs_create_u32("scan_period_max_ms", 0644, numa, &sysctl_numa_balanci= ng_scan_period_max); - debugfs_create_u32("scan_size_mb", 0644, numa, &sysctl_numa_balancing_sca= n_size); + debugfs_create_file_unsafe("scan_size_mb", 0644, numa, + &sysctl_numa_balancing_scan_size, &numa_scan_size_fops); debugfs_create_u32("hot_threshold_ms", 0644, numa, &sysctl_numa_balancing= _hot_threshold); #endif /* CONFIG_NUMA_BALANCING */ =20 --=20 2.9.4