Commit a3c3fb2f authored by Cheng-Yang Chou's avatar Cheng-Yang Chou Committed by Tejun Heo
Browse files

tools/sched_ext: Fix off-by-one in scx_sdt payload zeroing 



scx_alloc_free_idx() zeroes the payload of a freed arena allocation
one word at a time. The loop bound was alloc->pool.elem_size / 8, but
elem_size includes sizeof(struct sdt_data) (the 8-byte union sdt_id
header). This caused the loop to write one extra u64 past the
allocation, corrupting the tid field of the adjacent pool element.

Fix the loop bound to (elem_size - sizeof(struct sdt_data)) / 8 so
only the payload portion is zeroed.

Test plan:
- Add a temporary sanity check in scx_task_free() before the free call:

  if (mval->data->tid.idx != mval->tid.idx)
      scx_bpf_error("tid corruption: arena=%d storage=%d",
                    mval->data->tid.idx, (int)mval->tid.idx);

- stress-ng --fork 100 -t 10 & sudo ./build/bin/scx_sdt

Without this fix, running scx_sdt under fork-heavy load triggers the
corruption error. With the fix applied, the same workload completes
without error.

Fixes: 36929ebd ("tools/sched_ext: add arena based scheduler")
Signed-off-by: default avatarCheng-Yang Chou <yphbchou0911@gmail.com>
Reviewed-by: default avatarEmil Tsalapatis <emil@etsalapatis.com>
Signed-off-by: default avatarTejun Heo <tj@kernel.org>
parent 744ab12a

tools/sched_ext/scx_sdt.bpf.c

+2 −1
Original line number Diff line number Diff line
@@ -317,7 +317,8 @@ int scx_alloc_free_idx(struct scx_allocator *alloc, __u64 idx) 
		};



		/* Zero out one word at a time. */

		for (i = zero; i < alloc->pool.elem_size / 8 && can_loop; i++) {

		for (i = zero; i < (alloc->pool.elem_size - sizeof(struct sdt_data)) / 8

		     && can_loop; i++) {

			data->payload[i] = 0;

		}

	}