sched_ext: Build the set_cmask scratch from trusted geometry

Browse source

scx_call_op_set_cpumask() builds a per-cpu cmask in the set_cmask scratch,
which lives in BPF-writable arena. A scheduler can corrupt the scratch's
inline header (base, nr_cids, alloc_words) from another cpu, so sizing and
indexing the write from it risks an out-of-bounds write.

Drive the build from kernel-known geometry instead.
scx_cmask_ref_init_kern() imposes base and nr_cids rather than reading them,
and scx_cmask_ref_from_cpumask() fills the scratch from the ref. Neither
reads the header back.

Signed-off-by: Tejun Heo <tj@kernel.org>
Reviewed-by: Andrea Righi <arighi@nvidia.com>

...

This commit is contained in:

Tejun Heo 2026-07-13 22:18:42 -10:00

parent cc7c254c8f

commit 33ffb56e85

3 changed files with 81 additions and 4 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

70

kernel/sched/ext/cid.c

View file

4

kernel/sched/ext/cid.h

View file

11

kernel/sched/ext/ext.c

View file