Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

tools/sched_ext: Fix off-by-one in scx_sdt payload zeroing

scx_alloc_free_idx() zeroes the payload of a freed arena allocation
one word at a time. The loop bound was alloc->pool.elem_size / 8, but
elem_size includes sizeof(struct sdt_data) (the 8-byte union sdt_id
header). This caused the loop to write one extra u64 past the
allocation, corrupting the tid field of the adjacent pool element.

Fix the loop bound to (elem_size - sizeof(struct sdt_data)) / 8 so
only the payload portion is zeroed.

Test plan:
- Add a temporary sanity check in scx_task_free() before the free call:

if (mval->data->tid.idx != mval->tid.idx)
scx_bpf_error("tid corruption: arena=%d storage=%d",
mval->data->tid.idx, (int)mval->tid.idx);

- stress-ng --fork 100 -t 10 & sudo ./build/bin/scx_sdt

Without this fix, running scx_sdt under fork-heavy load triggers the
corruption error. With the fix applied, the same workload completes
without error.

Fixes: 36929ebd17ae ("tools/sched_ext: add arena based scheduler")
Signed-off-by: Cheng-Yang Chou <yphbchou0911@gmail.com>
Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
Signed-off-by: Tejun Heo <tj@kernel.org>

authored by

Cheng-Yang Chou and committed by
Tejun Heo
a3c3fb2f 744ab12a

+2 -1
+2 -1
tools/sched_ext/scx_sdt.bpf.c
··· 317 317 }; 318 318 319 319 /* Zero out one word at a time. */ 320 - for (i = zero; i < alloc->pool.elem_size / 8 && can_loop; i++) { 320 + for (i = zero; i < (alloc->pool.elem_size - sizeof(struct sdt_data)) / 8 321 + && can_loop; i++) { 321 322 data->payload[i] = 0; 322 323 } 323 324 }