[PATCH v1] sched_ext: finish scheduler init before publishing ops priv

[PATCH v1] sched_ext: finish scheduler init before publishing ops priv

[Binbin Deng]

scx_alloc_and_add_sched() assigns ops->priv before initializing the
scheduler's kobject, list linkage, and sub-scheduler kset, and before
consuming the BPF arena reference.  BPF kfuncs resolve the scheduler with
scx_prog_sched(), whose readers dereference ops->priv under RCU.  Once the
pointer is published, a program can therefore use fields that the creation
path has not initialized yet.

Attach a sched_ext struct_ops program that reaches one of those kfuncs
while registration is still completing.  Delay publication until after all
failure-prone initialization and arena setup have succeeded and
cmd->arena_map has been transferred to the scheduler.

Found during a static-analysis-assisted audit: candidate sites were
surfaced by a Coccinelle rule, and the reader/writer paths were
confirmed by LLM-assisted (GLM-5.3) code inspection.  The issue was
not observed at runtime; it is identified by code inspection only.

Fixes: 105dcd005be2 ("sched_ext: Introduce scx_prog_sched()")
Cc: stable@vger.kernel.org
Signed-off-by: Binbin Deng <18983559317@163.com>
---
 kernel/sched/ext/ext.c | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/kernel/sched/ext/ext.c b/kernel/sched/ext/ext.c
index 3219f0da0fe4..bd79bb692cb9 100644
--- a/kernel/sched/ext/ext.c
+++ b/kernel/sched/ext/ext.c
@@ -7305,13 +7305,6 @@ struct scx_sched *scx_alloc_and_add_sched(struct scx_enable_cmd *cmd,
 	INIT_LIST_HEAD(&sch->sibling);
 #endif	/* CONFIG_EXT_SUB_SCHED */
 
-	/*
-	 * Publishing makes @sch visible to scx_prog_sched() readers. Failure
-	 * paths after this point must free @sch through kobject_put() whose
-	 * release path defers the actual freeing by an RCU grace period.
-	 */
-	rcu_assign_pointer(ops->priv, sch);
-
 	sch->kobj.kset = scx_kset;
 	INIT_LIST_HEAD(&sch->all);
 
@@ -7345,6 +7338,14 @@ struct scx_sched *scx_alloc_and_add_sched(struct scx_enable_cmd *cmd,
 		sch->arena_kern_base = bpf_arena_map_kern_vm_start(sch->arena_map);
 #endif
 	cmd->arena_map = NULL;
+
+	/*
+	 * Publishing makes @sch visible to scx_prog_sched() readers. Failure
+	 * paths after this point must free @sch through kobject_put() whose
+	 * release path defers the actual freeing by an RCU grace period.
+	 */
+	rcu_assign_pointer(ops->priv, sch);
+
 	return sch;
 
 #ifdef CONFIG_EXT_SUB_SCHED
-- 
2.43.0

Re: [PATCH v1] sched_ext: finish scheduler init before publishing ops priv

[Andrea Righi]

Hi Binbin,

On Thu, Oct 15, 2026 at 04:14:31PM +0800, Binbin Deng wrote:
> scx_alloc_and_add_sched() assigns ops->priv before initializing the
> scheduler's kobject, list linkage, and sub-scheduler kset, and before
> consuming the BPF arena reference.  BPF kfuncs resolve the scheduler with
> scx_prog_sched(), whose readers dereference ops->priv under RCU.  Once the
> pointer is published, a program can therefore use fields that the creation
> path has not initialized yet.
> 
> Attach a sched_ext struct_ops program that reaches one of those kfuncs
> while registration is still completing.  Delay publication until after all
> failure-prone initialization and arena setup have succeeded and
> cmd->arena_map has been transferred to the scheduler.
> 
> Found during a static-analysis-assisted audit: candidate sites were
> surfaced by a Coccinelle rule, and the reader/writer paths were
> confirmed by LLM-assisted (GLM-5.3) code inspection.  The issue was
> not observed at runtime; it is identified by code inspection only.

I don't see any kfunc that can run in this window and access a field that is
still uninitialized. In particular, the sub-scheduler kset is created later,
after either publication point. I also don't see a fallible operation between
the old and new publication points. What failure does this change prevent?

Please always provide a reproducer or a clear, concrete code path to the
reported failure before sending a fix.

Thanks,
-Andrea

> 
> Fixes: 105dcd005be2 ("sched_ext: Introduce scx_prog_sched()")
> Cc: stable@vger.kernel.org
> Signed-off-by: Binbin Deng <18983559317@163.com>
> ---
>  kernel/sched/ext/ext.c | 15 ++++++++-------
>  1 file changed, 8 insertions(+), 7 deletions(-)
> 
> diff --git a/kernel/sched/ext/ext.c b/kernel/sched/ext/ext.c
> index 3219f0da0fe4..bd79bb692cb9 100644
> --- a/kernel/sched/ext/ext.c
> +++ b/kernel/sched/ext/ext.c
> @@ -7305,13 +7305,6 @@ struct scx_sched *scx_alloc_and_add_sched(struct scx_enable_cmd *cmd,
>  	INIT_LIST_HEAD(&sch->sibling);
>  #endif	/* CONFIG_EXT_SUB_SCHED */
>  
> -	/*
> -	 * Publishing makes @sch visible to scx_prog_sched() readers. Failure
> -	 * paths after this point must free @sch through kobject_put() whose
> -	 * release path defers the actual freeing by an RCU grace period.
> -	 */
> -	rcu_assign_pointer(ops->priv, sch);
> -
>  	sch->kobj.kset = scx_kset;
>  	INIT_LIST_HEAD(&sch->all);
>  
> @@ -7345,6 +7338,14 @@ struct scx_sched *scx_alloc_and_add_sched(struct scx_enable_cmd *cmd,
>  		sch->arena_kern_base = bpf_arena_map_kern_vm_start(sch->arena_map);
>  #endif
>  	cmd->arena_map = NULL;
> +
> +	/*
> +	 * Publishing makes @sch visible to scx_prog_sched() readers. Failure
> +	 * paths after this point must free @sch through kobject_put() whose
> +	 * release path defers the actual freeing by an RCU grace period.
> +	 */
> +	rcu_assign_pointer(ops->priv, sch);
> +
>  	return sch;
>  
>  #ifdef CONFIG_EXT_SUB_SCHED
> -- 
> 2.43.0
>