From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from YQZPR01CU011.outbound.protection.outlook.com (mail-canadaeastazon11020137.outbound.protection.outlook.com [52.101.191.137]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0E64735292A for ; Tue, 16 Jun 2026 21:40:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.191.137 ARC-Seal:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781646054; cv=fail; b=GlnF3H2M9HwGuZZhS7HaEyIP2X2+9/Xtp3838kgzQWcPaLSUel3gyg7ZOpatkmnROy6yIXRn+hHfUn5+E8+P8GRzesES3g981Zg1Chifi6aY1OOmpHPZ++EK68JHUETEU2YLDPJQuS63eoOk8pkZovVYcb9vvsFAbmEJlyefmsU= ARC-Message-Signature:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781646054; c=relaxed/simple; bh=DEedCV8I4JEmVzre5cGeUWSnvaKUAZKG8QzF38BxLQ8=; h=Message-ID:Date:Subject:To:Cc:References:From:In-Reply-To: Content-Type:MIME-Version; b=U5uKnywkXPItL0ezg5GW7T9D1EtpnVfGIs2m5P2sXnwOOkpPOOH3p4NL0f73tC0+FNqx+mgOU1AT+uq36+25tBVLNoBzIBmhYl0s9a36x84LwZVhDqKU+lxmqRiqPXXCPhGljb7ZdoXLmp3HugT7WJDf5r8AjFVhSgYllUSqeSw= ARC-Authentication-Results:i=2; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=efficios.com; spf=pass smtp.mailfrom=efficios.com; dkim=pass (2048-bit key) header.d=efficios.com header.i=@efficios.com header.b=VzwTxSNA; arc=fail smtp.client-ip=52.101.191.137 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=efficios.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=efficios.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=efficios.com header.i=@efficios.com header.b="VzwTxSNA" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=ebRRwrxyQLIBihq74AXpapORSDwiAtlXkPQ2b3E2ZC4mmg7cb2WJwKHjQsIsWQNp7Fn6TbNmZQ9d/pwE46I5grAVuuCfiUzcCFLwT1OPs9Gne/ecQiR+TImIG6XKEt7/3Lox/1OmyqGPdS3vKShxwB9WzxE0igC/5P4UXrBHtwna3Zeyl3t9QyBVRo85osEQ8ZUUIdxFQmr20ge68gg0RVaiPxMKuHVnDW2PAWEN0j6B0XoaKg/xcC6+J6E1EGHGAqabQ8oJS9sKVToy56zfEqcadqnvG9tCq62YqvWnAqAhTKaggoONXg7GiFcp/Ml00N6vpnNUB5YJ/VvXkTdz2g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=Nv/8vnG3hh/yICQ/+Q+r8uX7+jg4DrDPQ9QwBe5eNro=; b=JuxirU/VullUXDN5MwX40vcxd0a2xznCafy6v3PyHeBZ4Xz1Hr2uvBNxc++7Kh/SatOsh94c0f7vYhsicruLcML5GyLfv8ahMQFXfwDnoXq4MS25g/DYGGh66NY7tgc56HMx97w7KBPyOvYDyVshZ5EWAM1eOfDdXJ3ucGYOAIZ9xLpMfmTjxfpR4w89s7mOU3gcNeeVwpMBw8baw4WZCgjTBXBl572Tl04jLEw9y40RhWi+FIzEA7WlfaWb0cvhmew1bu1GuF/IYF8ncEmBiDobjMEbfT1b1fx3q/N/MvkPNEAExmhy1UcXweO5SNe39Go4LgFpBuBjGAWJxKY8lw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=efficios.com; dmarc=pass action=none header.from=efficios.com; dkim=pass header.d=efficios.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=efficios.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Nv/8vnG3hh/yICQ/+Q+r8uX7+jg4DrDPQ9QwBe5eNro=; b=VzwTxSNA6Aq0DZJ21uYd+ZNFABby13S2bgnBeEu17aGZb/whiItSVmOzeQmdPsUjmHdjGlp/xWuHpq8bHT/wsOYT+8tsBjtbJwQ5Bb/gooENVWkBeN7Xu/5nqHZLXkhCvfkzJ2CaFl17fhPahdtw7h5FEq7QG4wBhaDwHDm4Fl+4abKFkhxIjawJ1Mm4oA0N1A5wBItdV4CkFyWWjuTYdvMFLCsKntGH75cY4sg6A+/yB3/JHoHmx8CpTX+RmRq4/6ObGfeiYQNZ0lOvHL8fiQJzyNaSTLGr3eWyJEyzknqZYAV/sNkBV44D/jF3YfKEAGz1zIcaEgByXPn7NLYZoQ== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=efficios.com; Received: from YT2PR01MB9175.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:b01:be::5) by YQ1PR01MB11660.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:c01:c0::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.139.11; Tue, 16 Jun 2026 21:40:49 +0000 Received: from YT2PR01MB9175.CANPRD01.PROD.OUTLOOK.COM ([fe80::6004:a862:d45d:90c1]) by YT2PR01MB9175.CANPRD01.PROD.OUTLOOK.COM ([fe80::6004:a862:d45d:90c1%3]) with mapi id 15.21.0139.009; Tue, 16 Jun 2026 21:40:49 +0000 Message-ID: <9725f2c5-24fb-4d93-ab8d-33ecaf612ca7@efficios.com> Date: Tue, 16 Jun 2026 17:40:47 -0400 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH v3] sched/mmcid: fix OOB clear_bit when CID is MM_CID_UNSET in fixup path To: Rik van Riel , linux-kernel@vger.kernel.org, Thomas Gleixner Cc: kernel-team@meta.com, Ingo Molnar , Peter Zijlstra , Juri Lelli , Vincent Guittot , Dietmar Eggemann , Steven Rostedt , Ben Segall , Mel Gorman , Valentin Schneider , K Prateek Nayak References: <20260616203818.1516263-1-riel@surriel.com> From: Mathieu Desnoyers Content-Language: en-US In-Reply-To: <20260616203818.1516263-1-riel@surriel.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-ClientProxiedBy: YQZPR01CA0027.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:c01:86::8) To YT2PR01MB9175.CANPRD01.PROD.OUTLOOK.COM (2603:10b6:b01:be::5) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: YT2PR01MB9175:EE_|YQ1PR01MB11660:EE_ X-MS-Office365-Filtering-Correlation-Id: ee53b0f0-bdff-4f4d-1e06-08decbefee4b X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|7416014|10070799003|376014|1800799024|366016|23010399003|6133799003|22082099003|18002099003|56012099006; X-Microsoft-Antispam-Message-Info: 9HEy0Iqxq+511MTVSrot14+WUNzBJJtpClaQAOTraFXq/km/kdOjzrAKnac7xa5lE6Z+DRoGWBSJ7lhEOTaabE6qJH8xeg25fXYj5xcYZcP+NsTcFAluP5PgY1MrVK7+4p2DPC3u33Z7dWHAXZDh7aU4USSzBdbhrvJQyjrh2BZIz7rryikjEyUP3bmU75A6WTsMQ6JA0Vn685PgDzmDyM8t/V6t4K73NlGpS6F5fHkoggKTBXmogHOuFIy9vT2DC+OechZQl0NFnh6pYsH4UOeIEqEomgWYwS5P/KntXJs+1CDWLGYK9lGvQdieRFqlvoLXohHg+sDB1oPxXYHMFq2IgWsPm0JMRP40Onpw5+UHI9AOhxeuDLv/2h6fq+EpkWYPgZnFyOPcSZigd3OQMKUjO+uzOyiz42YuSHPdEliJhLZhTRyUh6cpsq+w5JfIizR7dmFPXRHnynoQUBos/yJU+0hj3x6ztY4uUz76fVndKuUqFbOPGkmMFd3tBRZKWIHGxCZLUlmIzMYY99QLl2qY5JqZKUhh6eRFsozDCVxcWvbRPqB4fXDrX4P87uq/200rkFl3K5aIesETWx8urwc02Ju7c6XcFN5MoBu8bYec5POkaYtga81wnDwjtwMLYZxiVtcj+PYJDrAvn+W+QQ== X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:YT2PR01MB9175.CANPRD01.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(7416014)(10070799003)(376014)(1800799024)(366016)(23010399003)(6133799003)(22082099003)(18002099003)(56012099006);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 2 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?R2VGZGVldlhNdFc2MnVrRmx6MEkyckRYaU56UnhtUTMydVdRQklKTVVRaG9r?= =?utf-8?B?TytpYkYybE92TmxpeC9aVWpVdzB5ZDdSeUM1clVmakthVVZsSEM3L0xPY2M4?= =?utf-8?B?YjFzY2JGaWFHNDJRQ1ZFR3lBNG5lTk1remVURU95RWw2bUFnWmlCVW5iVWhZ?= =?utf-8?B?dFFRaWNodFR0OEJlRk8weEFYdHhxVHlWbVk4TWUreWdEVXgyc2dxU2RnT0I2?= =?utf-8?B?dSs0Z1dmWS84aUZydWczbkx0dDk3eC95ditaakFudXc4NnFSUk5CL0hDd01z?= =?utf-8?B?VnpzSEpOYkxEU0RVTk1rUkhwTXdReHNLNHJEVUM5LyszSnJjRHVvcTdDV1dB?= =?utf-8?B?UGRsZE9XMVZheU9UU3pUZnZ0M1hyKzU4MEtnbXFma1ZqU1M0OEx6NndzVkZ3?= =?utf-8?B?VDY0UHpnaHAwSXVQSTJlbzVLRGdYZWl5cThkSlF1SjM5d1JvbURWWnBQM0JU?= =?utf-8?B?N2Z1S0paUWZ3YllpQVhoTE1ZWG94Y214a2gwME1WR1krUkg5R1dYZG5BK0RX?= =?utf-8?B?UDZaQXVQTDFxbXhzRUMrNGhKdHB1TGdMekFUMGZ3eXFGMXV2TG9kRy9RbS8r?= =?utf-8?B?WmdDTmlESHNCQlpuZEE1MFgyaGsva1lzcjM4R0RBUTlkOWxiRzRhQnJtZGs4?= =?utf-8?B?eE9saFdKTzlTd1o3aXZoVDFCc09hRGN6VnZzZGhsKzhEMzVUd2V0MnVBaVp0?= =?utf-8?B?cTNuMkM3akRrbHdpcDB5ZFhzYUoxM2ZUMnJEY05GbEJ0SUFxWmZMb2dtR1VS?= =?utf-8?B?aFEvVUt4NlpyV0pIakNOZlFSbnk4SDJsamNncmdKYW9aMFVqSG5qZlFRTUFj?= =?utf-8?B?cFNmeGNZRVN6QkEraTlpK3o3VEYzaFRjU1pNVm91SERpRlErSUNPTCtPZXlD?= =?utf-8?B?b3R3aGdKYzk2Z2ZWN2pYbVNzbUF3MnpkYW5GOG9hQ0F5NUtieU41T1Q0TFVW?= =?utf-8?B?ckZ4MGNabHpLN2duNW0xcGllQlhrczdyaVBVblJINXRJMGNLS0pVY1NOYkJ0?= =?utf-8?B?TytqTnN5cGRCb0pSVWdOcUJ5N095emlGSWlIV2c0RVZxQjJCTDNPeDFCL1FP?= =?utf-8?B?RFI5UFRmY2xGSGowQkY2ZkZGcHE1R0FuSWhyVzN2MHhPdS95Si9oSnE4eXpo?= =?utf-8?B?ektrVXVoV2tSTk1yU2JzWnRkWHNXZ1pqeE9qSzZjaTNuQk9VQjZaMW1NWUUv?= =?utf-8?B?d1lzYlJYbFB4SE9LYTlHK2lKOFBUN1IrQ255ams5bXVWTG55MXRzS3VwaTRq?= =?utf-8?B?ekhYYXF3SEVzQ1oyZ1N6ZVJ2b2d6OXVzczVuSTJ4WWcwRmQ5dEptbDFqVnIy?= =?utf-8?B?SlBpSndhMzQ5OUgyQWl3NlJiTFNScU1idTZ3WUpjRmYzTHFoOXpyWTJieHRu?= =?utf-8?B?RFJCdlJvbnFFRE9wT0JvalN3L2YyZE1UOC8yMzhlV0lURHR3ajV6RjJvM2do?= =?utf-8?B?SFllRGhjbWVPSkpldkVNYWFJV1NKTVFucTF5MTBPUXo5Z1NENlVXQ3pFNUY0?= =?utf-8?B?a0w1cStIbk5zc29hMzN0VGlRb0Q1dFlpOTB4eWVtUnl2bVR3Nkk4eVBZKy9q?= =?utf-8?B?N0ZCN1ZYN1JaSmdwa3gvVW1rRmtRK1hlNDRVUzZ6RU01MDBHczIrT3pXL0xO?= =?utf-8?B?cnJ2d245LzdMK3htdDR3TW1YYjZycmt5ZFczY3ZObTU2L0lNUHJneEI3MERH?= =?utf-8?B?L3lKUlNDZnVNQ3JTdGhZTCtvQnVxc3pXRDFLUVBwV2hlNjRXTUsxQkZwMG1M?= =?utf-8?B?dGp3dUs2Wlc5ZitNVjB1QzBUdFYzdG9GSGJ1RmZSWlZMd1dNQjg1QW1jRktY?= =?utf-8?B?RGFULzNpK3BaSEd1TnBaQWcxSERkOE5iYWNVdXBvL2JkZWlhZEhobFJEb1J0?= =?utf-8?B?ODJHZFJGU3lZZ1k3VkV1RytJeEliRHF0MGU1VkdaVnc1VVRlV3FEcThzanpN?= =?utf-8?B?L2JKaSszeGZKV09HRjNWN2Q0QzdqMDRRK0tKRzNraDYvYjVjMUNzWDhQMmlQ?= =?utf-8?B?TVdpaFpPOG9oUjhwWXhLb0U2Q28xVG9sSC9Dem8rQlpabVUwTVh6WGJXYlpD?= =?utf-8?B?QmRxQkx4OU5IaFpFSjY3alo3T2YrdTN3V2EwckJpc2hOeTUvaDlkSjFZcG1Y?= =?utf-8?B?MXRScjFVZUZ0VHdqUnROa3dlU0NIb0xub2dnWUE4ZkFoSEJoS1Mya3ZFVTN5?= =?utf-8?B?Ry9NaHB1a2VURGZDdEhFZVhwTHNzaHhhb0F1QW13VHp6TWZDZlhNQXN1STdR?= =?utf-8?B?VjNvM3pxRHJDbE0rM0xkYUJiN2NIZmtSRmRsa0JqK3hGUy9PVVNpelVVYjFV?= =?utf-8?B?SUZKT3o1dGtobGtBN1RNZnpOWWtmVUNuWnphS3lzVVViMGMyQ29sMTVMS2pF?= =?utf-8?Q?kHkAVaOwj7/CBjuU3mr325olhGym+MTvqjAw+7dS9TvKT?= X-MS-Exchange-AntiSpam-MessageData-1: BlG+uv9ACvfkWto8Qq63DHL+7G8a0lJxYpw= X-OriginatorOrg: efficios.com X-MS-Exchange-CrossTenant-Network-Message-Id: ee53b0f0-bdff-4f4d-1e06-08decbefee4b X-MS-Exchange-CrossTenant-AuthSource: YT2PR01MB9175.CANPRD01.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 16 Jun 2026 21:40:49.0208 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 4f278736-4ab6-415c-957e-1f55336bd31e X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: W4FEzSD+gVs4gMFdUBHWEzR0fniBkxL+sE2pIi14PNFUhcRnpy830SThH7rb7iF9RHl4nHY2xYMGgPodbDDemyrUCHKUNDmxPBwkpCa8EmE= X-MS-Exchange-Transport-CrossTenantHeadersStamped: YQ1PR01MB11660 On 2026-06-16 16:38, Rik van Riel wrote: > In mm_cid_fixup_cpus_to_tasks(), when rq->curr has the target mm and > mm_cid.active is set, the CID is checked with cid_in_transit() before > setting the transition bit. In per-CPU mode a newly forked or exec'd > task can be running with mm_cid.cid == MM_CID_UNSET because CIDs are > assigned lazily on schedule-in. With cid_in_transit() the guard passes > for MM_CID_UNSET (no transit bit), converts it to MM_CID_UNSET | > MM_CID_TRANSIT and stores it back; later mm_cid_schedout() feeds this > to clear_bit() with MM_CID_UNSET as the bit number, triggering an > out-of-bounds write. Thomas, can you have a look as well in case we missed something subtle ? Rik, did you check whether there are other instances of that MM_CID_UNSET issue lurking in the code, or was your analysis focused on the reproduced bug ? Reviewed-by: Mathieu Desnoyers Thanks, Mathieu -- Mathieu Desnoyers EfficiOS Inc. https://www.efficios.com