From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from casper.infradead.org (casper.infradead.org [90.155.50.34]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B47F81D5AD4 for ; Tue, 10 Feb 2026 13:03:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=90.155.50.34 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770728599; cv=none; b=FAUkpPhS+/XZCahANFZRtfRd0pKL4l8YiNBrU/Kl3EH+r/XSafwcfbalX7eLyoD35a8giXxQ2+fgABF1ROO6YNYXpcIpUx6UM3wNooA7mPhGv9WX4Ugxug2DlwqPkFKnHP07WVDAahT8ZinQ/dFjROJ0Mtq9mIGL6a637VNvEvE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770728599; c=relaxed/simple; bh=hQULl5BQj6s1DKLfdVOH9oz1jRc00dC4OQI7wJmS/qc=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=m7qasXxaBNwBDMmeG4L2QlRF2HyJHJ32JhYSkE9JNw7GG4cWi/srjmZHpGthaycQY72hoG8KmTgE/eSzIw+UVj5pkmAGy7PCkUqNrEYJXQW02K4kp88iBrRpBCVUsHNpW40K632RndKRkLDNuyn69d8opR/P6hqiExmdhZjxK1c= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=infradead.org; spf=none smtp.mailfrom=infradead.org; dkim=pass (2048-bit key) header.d=infradead.org header.i=@infradead.org header.b=EtP/dlOQ; arc=none smtp.client-ip=90.155.50.34 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=infradead.org Authentication-Results: smtp.subspace.kernel.org; spf=none smtp.mailfrom=infradead.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=infradead.org header.i=@infradead.org header.b="EtP/dlOQ" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=casper.20170209; h=In-Reply-To:Content-Type:MIME-Version: References:Message-ID:Subject:Cc:To:From:Date:Sender:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description; bh=i/zBtisYtjrdVvQ/FDQxbIL22fhD5YUfBd/rImcs+ZQ=; b=EtP/dlOQzJYu33HDS5F5/YYE4k 9LBi6cA5OX2tnE9CTFld/L67j22Oh2Tiw6kcVQc/zLtu4C6Fxi2WHQ5eAf4UObiNgI9CuptcjuIO5 E40R/qTVQELgkvRU91T2QLdnhYyMUDenro5jW5QBgaM6SGEda56qFVkNjDn3BlCnXi3wHGA2Sga3Y Lh5J64sJHoqTwd9k8H5MCHQeQx+e094no+yA7CvSdBAJUuTtKF7g2NrRrkU4TPagsseWRkxCkA3/B qHUPpRvhpTLORIkOxn7qsqAOQx6/8eD7QGMSehBMuf9eTThmXrqg07+q01znoy+eUEWyfmGMWZWnJ 1ZFysXZA==; Received: from 2001-1c00-8d85-5700-266e-96ff-fe07-7dcc.cable.dynamic.v6.ziggo.nl ([2001:1c00:8d85:5700:266e:96ff:fe07:7dcc] helo=noisy.programming.kicks-ass.net) by casper.infradead.org with esmtpsa (Exim 4.98.2 #2 (Red Hat Linux)) id 1vpnOX-0000000B6bH-2S16; Tue, 10 Feb 2026 13:03:09 +0000 Received: by noisy.programming.kicks-ass.net (Postfix, from userid 1000) id 14B64300754; Tue, 10 Feb 2026 14:03:08 +0100 (CET) Date: Tue, 10 Feb 2026 14:03:08 +0100 From: Peter Zijlstra To: Shinichiro Kawasaki Cc: Thomas Gleixner , LKML , Ihor Solodrai , Shrikanth Hegde , Mathieu Desnoyers , Michael Jeanson , Andrey Ryabinin , Alexander Potapenko , "kasan-dev@googlegroups.com" Subject: Re: [patch V2 3/4] sched/mmcid: Drop per CPU CID immediately when switching to per task mode Message-ID: <20260210130308.GH3016024@noisy.programming.kicks-ass.net> References: <20260201192234.380608594@kernel.org> <20260201192835.032221009@kernel.org> <873438c1zc.ffs@tglx> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: On Tue, Feb 10, 2026 at 11:51:10AM +0000, Shinichiro Kawasaki wrote: > On Feb 10, 2026 / 11:44, Thomas Gleixner wrote: > > On Tue, Feb 10 2026 at 07:33, Shinichiro Kawasaki wrote: > [...] > > > [ 65.768341] [ T1296] BUG: KASAN: slab-use-after-free in sched_mm_cid_exit+0x298/0x500 > > > > Can you please decode these symbols (file/line) so that we actually see > > which access is flagged by KASAN? > > Sure, faddr2line points to the line the patch touched: > > $ ./scripts/faddr2line vmlinux sched_mm_cid_exit+0x298/0x500 > sched_mm_cid_exit+0x298/0x500: > arch_clear_bit at arch/x86/include/asm/bitops.h:79 > (inlined by) clear_bit at include/asm-generic/bitops/instrumented-atomic.h:42 > (inlined by) mm_drop_cid at kernel/sched/sched.h:3746 > (inlined by) mm_drop_cid_on_cpu at kernel/sched/sched.h:3762 > (inlined by) sched_mm_cid_exit at kernel/sched/core.c:10737 Could you please reproduce with the below added? Just to double check that that cid value isn't out of bounds. --- diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h index bd350e40859d..dadfd6abc1fa 100644 --- a/kernel/sched/sched.h +++ b/kernel/sched/sched.h @@ -3743,6 +3743,7 @@ static __always_inline bool cid_on_task(unsigned int cid) static __always_inline void mm_drop_cid(struct mm_struct *mm, unsigned int cid) { + WARN_ONCE(cid >= nr_cpu_ids, "XXX cid(%x) out of range(%x)\n", cid, nr_cpu_ids); clear_bit(cid, mm_cidmask(mm)); }