Re: [PATCH v3 sched_ext/for-7.3 13/36] sched_ext: Defer scx_sched kobj sysfs add into the enable workfns

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Moving sysfs addition into the new `scx_sched_sysfs_add()` helper introduces a new silent failure path in `scx_sub_enable_workfn()` that leaves the sub-scheduler in a half-initialized zombie state.
--

--- Patch [13]: [PATCH v3 sched_ext/for-7.3 13/36] sched_ext: Defer scx_sched kobj sysfs add into the enable workfns ---
commit 507940b158b167ff0f8a1c4f5cea84a731673de7
Author: Tejun Heo <tj@kernel.org>

sched_ext: Defer scx_sched kobj sysfs add into the enable workfns

This commit splits the sysfs kobject addition from the scheduler
initialization. It introduces a new scx_sched_sysfs_add() helper that is
called from the enable work functions once the scheduler's sysfs-visible
state is initialized.

> diff --git a/kernel/sched/ext/sub.c b/kernel/sched/ext/sub.c
> index 0504204272732..e94a415ee10a7 100644
> --- a/kernel/sched/ext/sub.c
> +++ b/kernel/sched/ext/sub.c

[ ... ]

> @@ -363,6 +365,10 @@ void scx_sub_enable_workfn(struct kthread_work *work)
>  	if (ret)
>  		goto err_disable;
>  
> +	ret = scx_sched_sysfs_add(sch);
> +	if (ret)
> +		goto err_disable;

[Severity: High]
If scx_sched_sysfs_add() fails (for example, due to ENOMEM in
kset_create_and_add()), does this jump to err_disable leave the
sub-scheduler in a zombie state?

Since scx_error() is not called before jumping here, the scheduler's
exit_kind remains SCX_EXIT_NONE, which means the disable work is never
queued. The scx_flush_disable_work() call in the error path will return
immediately, and the function will set cmd->ret = 0, falsely signaling
success to userspace.

This could leave the sub-scheduler partially initialized but fully linked
in scx_sched_hash and parent->children. If the parent scheduler then
dispatches tasks to it, or if it is disabled by userspace, could this
crash the kernel due to uninitialized structures?

> +
>  	if (sch->level >= SCX_SUB_MAX_DEPTH) {
>  		scx_error(sch, "max nesting depth %d violated",
>  			  SCX_SUB_MAX_DEPTH);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260707001229.1410929-1-tj@kernel.org?part=13