bugfix: clear scheduled field of the correct CPU upon task_exit in C-EDF

Do not use the "scheduled_on" field to address the cpus structure
within a cluster. cpus may contain less items than num_online_cpus and
we may cause an out-of-bound access. Instead, use "scheduled_on" to
directly access the per-cpu cpu_entry_t structure.

Reported-by: Jonathan Herman <hermanjl@cs.unc.edu>

1 files changed, 3 insertions, 1 deletions

diff --git a/litmus/sched_cedf.c b/litmus/sched_cedf.c
index 8c9513d33f59..e815e31b1d84 100644
--- a/litmus/sched_cedf.c
+++ b/litmus/sched_cedf.c
@@ -587,7 +587,9 @@ static void cedf_task_exit(struct task_struct * t)
         raw_spin_lock_irqsave(&cluster->lock, flags);
         unlink(t);
         if (tsk_rt(t)->scheduled_on != NO_CPU) {
-                cluster->cpus[tsk_rt(t)->scheduled_on]->scheduled = NULL;
+                cpu_entry_t *cpu;
+                cpu = &per_cpu(cedf_cpu_entries, tsk_rt(t)->scheduled_on);
+                cpu->scheduled = NULL;
                 tsk_rt(t)->scheduled_on = NO_CPU;
         }
         raw_spin_unlock_irqrestore(&cluster->lock, flags);