[PATCH v2] sched/autogroup: Make nice rate-limit updates atomic

[PATCH v2] sched/autogroup: Make nice rate-limit updates atomic

[Hui Su]

proc_sched_autogroup_set_nice() uses a function-static timestamp to
rate-limit the expensive sched_group_set_shares() operation.

The timestamp check and update are not atomic. Concurrent unprivileged
writers can therefore observe the same expired timestamp and proceed to
sched_group_set_shares(), weakening the intended throttling of this
expensive path.

Use try_cmpxchg() so that only one unprivileged caller can claim an
expired rate-limit window. A competing unprivileged caller which loses
the race returns -EAGAIN. Use xchg() for privileged callers so that
they retain their existing rate-limit bypass behavior while updating
the timestamp atomically.

Fixes: 5091faa449ee ("sched: Add 'autogroup' scheduling feature: automated per session task groups")
Suggested-by: K Prateek Nayak <kprateek.nayak@amd.com>
Signed-off-by: Hui Su <sh_def@163.com>
---
Testing:
- x86_64 KVM functional rate-limit oracle admitted one of eight
  synchronized unprivileged writers and returned -EAGAIN to the other
  seven.
- x86_64 KVM privileged and mixed-contention tests completed all
  CAP_SYS_ADMIN writes without -EAGAIN or errors; competing
  unprivileged writers were rate-limited as expected.
- x86_64 KVM KCSAN forced-overlap test admitted one writer and returned
  -EAGAIN to the other, with no proc_sched_autogroup_set_nice report.

Changes in v2:
- Replace the dedicated spinlock with try_cmpxchg() for unprivileged
  callers, as suggested by Prateek.
- Use xchg() for CAP_SYS_ADMIN callers to preserve their existing
  rate-limit bypass behavior.

v1: https://lore.kernel.org/lkml/20261008064440.240528-1-sh_def@163.com/
---
 kernel/sched/autogroup.c | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/kernel/sched/autogroup.c b/kernel/sched/autogroup.c
index e380cf9372bb..76fa3f287208 100644
--- a/kernel/sched/autogroup.c
+++ b/kernel/sched/autogroup.c
@@ -234,7 +234,7 @@ int proc_sched_autogroup_set_nice(struct task_struct *p, int nice)
 {
 	static unsigned long next = INITIAL_JIFFIES;
 	struct autogroup *ag;
-	unsigned long shares;
+	unsigned long shares, old;
 	int err, idx;
 
 	if (nice < MIN_NICE || nice > MAX_NICE)
@@ -247,11 +247,15 @@ int proc_sched_autogroup_set_nice(struct task_struct *p, int nice)
 	if (nice < 0 && !can_nice(current, nice))
 		return -EPERM;
 
-	/* This is a heavy operation, taking global locks.. */
-	if (!capable(CAP_SYS_ADMIN) && time_before(jiffies, next))
-		return -EAGAIN;
+	/* Rate-limit this heavy operation, which takes global locks. */
+	if (capable(CAP_SYS_ADMIN)) {
+		xchg(&next, HZ / 10 + jiffies);
+	} else {
+		old = READ_ONCE(next);
+		if (time_before(jiffies, old) || !try_cmpxchg(&next, &old, HZ / 10 + jiffies))
+			return -EAGAIN;
+	}
 
-	next = HZ / 10 + jiffies;
 	ag = autogroup_task_get(p);
 
 	idx = array_index_nospec(nice + 20, 40);

base-commit: 6f8319e3e9a44dd537d17f41565a8453c560a581