github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-27 11:02:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

tools/sched_ext: scx_flatcg: Fix uninitialized stats on allocation failure

Browse Source 
In fcg_read_stats(), the memset() that zeroes the output @stats array
sits after the calloc() failure check. When calloc() fails, the
function returns without writing @stats.

The caller in main() declares acc_stats uninitialized, passes it as
the @stats argument, and then reads it unconditionally:

    __u64 acc_stats[FCG_NR_STATS];
    fcg_read_stats(skel, acc_stats);
    stats[i] = acc_stats[i] - last_stats[i];   // reads garbage

Because fcg_read_stats() returns void, the caller cannot detect the
failure. Reading the uninitialized array is undefined behavior, and
the garbage is further copied into last_stats via memcpy(), corrupting
the baseline used by the next interval.

This regression was introduced by commit cabd76bbc0 ("tools/sched_ext:
scx_flatcg: fix potential stack overflow from VLA in fcg_read_stats"),
which replaced the VLA with calloc() and inserted the failure check
before the existing memset().

Move the memset() above the calloc() failure check so @stats is always
zeroed regardless of allocation outcome.

Fixes: cabd76bbc0 ("tools/sched_ext: scx_flatcg: fix potential stack overflow from VLA in fcg_read_stats")
Signed-off-by: Liang Luo <luoliang@kylinos.cn>
Reviewed-by: Andrea Righi <arighi@nvidia.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
This commit is contained in:
Liang Luo 2026-07-13 15:18:08 +08:00 committed by Tejun Heo
parent cbcda14b12
commit e07f6bb73e
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
tools/sched_ext/scx_flatcg.c
View File

@ -105,12 +105,12 @@ static void fcg_read_stats(struct scx_flatcg *skel, __u64 *stats)
__u64 *cnts;
__u32 idx;
memset(stats, 0, sizeof(stats[0]) * FCG_NR_STATS);
cnts = calloc(skel->rodata->nr_cpus, sizeof(__u64));
if (!cnts)
return;
memset(stats, 0, sizeof(stats[0]) * FCG_NR_STATS);
for (idx = 0; idx < FCG_NR_STATS; idx++) {
int ret, cpu;