Re: [PATCH v3 sched_ext/for-7.3 20/36] sched_ext: Add coalescing sub_caps_updated() notifier for sub-schedulers

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] NULL pointer dereference in scx_bpf_sub_grant() and scx_bpf_sub_revoke() when a sub-scheduler is not a cid-form scheduler.
--

--- Patch [20]: [PATCH v3 sched_ext/for-7.3 20/36] sched_ext: Add coalescing sub_caps_updated() notifier for sub-schedulers ---
commit 65f0b1ee489afa8a5521ffd4929c36ec04dc1300
Author: Tejun Heo <tj@kernel.org>
Subject: sched_ext: Add coalescing sub_caps_updated() notifier for sub-schedulers

This commit wires up ops_cid.sub_caps_updated() to notify sub-schedulers of
cap changes. It introduces a coalesced notification mechanism to handle
high-frequency updates and deferred delivery to prevent deep recursion.

> diff --git a/kernel/sched/ext/sub.c b/kernel/sched/ext/sub.c
> --- a/kernel/sched/ext/sub.c
> +++ b/kernel/sched/ext/sub.c
[ ... ]
> @@ -887,6 +1010,7 @@ __bpf_kfunc s32 scx_bpf_sub_grant(u64 cgroup_id, u64 caps,
>  		SCX_CMASK_DEFINE_SHARD(slice, 0, SCX_CID_SHARD_MAX_CPUS);
>  		struct scx_pshard *pps = parent->pshard[si];
>  		struct scx_pshard *cps = child->pshard[si];

[Severity: High]
Can this result in a NULL pointer dereference if the sub-scheduler is not a
cid-form scheduler?

If a user loads a root scheduler that is cid-form, and then loads and attaches
a sub-scheduler that is cpu-form (or lacks an arena pool), scx_alloc_pshards()
might leave child->pshard as NULL.

Since sub_cap_preamble() only verifies that the root is cid-form without
checking the child's type, could dereferencing child->pshard[si] cause a crash
here?

> +		u64 granted_caps = 0;
>  		u32 cap_bit;
>  
>  		scx_cmask_ref_shard(&ref, si, slice);
[ ... ]
> @@ -974,18 +1122,32 @@ __bpf_kfunc void scx_bpf_sub_revoke(u64 cgroup_id, u64 caps,
>  		pos = scx_next_descendant_pre(NULL, child);
>  		while (pos) {
>  			struct scx_pshard *ps = pos->pshard[si];

[Severity: High]
Similarly, can this dereference pos->pshard[si] when a descendant is a
cpu-form scheduler?

If pos->pshard is NULL for any descendant in the hierarchy, this loop would
dereference a NULL pointer.

> +			SCX_CMASK_DEFINE_SHARD(changed_cids, slice->base, slice->nr_cids);
> +			SCX_CMASK_DEFINE_SHARD(delta, slice->base, slice->nr_cids);
>  			u64 revoked_caps = 0;
>  			u32 cap_bit;
>  
[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260707001229.1410929-1-tj@kernel.org?part=20