Re: [PATCH sched_ext/for-7.3-fixes] sched_ext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] sched/ext: build failure due to non-existent member pcpu in struct scx_dispatch_q
--

commit be226bed0faf80d9afdf2b8cee5244f38b4976cc
Author: Tejun Heo <tj@kernel.org>

sched_ext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue

This commit cancels pending requests before an RCU grace period when destroying
a user DSQ to prevent a use-after-free race condition with run_deferred().

Link: https://lore.kernel.org/all/20261008024753.4096008-1-sh_def@163.com/

> diff --git a/kernel/sched/ext/ext.c b/kernel/sched/ext/ext.c
> --- a/kernel/sched/ext/ext.c
> +++ b/kernel/sched/ext/ext.c

[ ... ]

> @@ -5656,8 +5660,26 @@ static void free_dsq_irq_workfn(struct irq_work *irq_work)
>  	struct llist_node *to_free = llist_del_all(&dsqs_to_free);
>  	struct scx_dispatch_q *dsq, *tmp_dsq;
>  
> -	llist_for_each_entry_safe(dsq, tmp_dsq, to_free, free_node)
> +	llist_for_each_entry_safe(dsq, tmp_dsq, to_free, free_node) {
> +		s32 cpu;
> +
> +		/*
> +		 * Cancel pending reenqs. Only a run_deferred() that started
> +		 * before the grace period can hold one, and it keeps IRQs off,
> +		 * so the grace period waits for it. After this sweep,
> +		 * schedule_dsq_reenq() sees the invalid id under the same lock
> +		 * and queues nothing.
> +		 */
> +		for_each_possible_cpu(cpu) {
> +			struct scx_dsq_pcpu *pcpu = per_cpu_ptr(dsq->pcpu, cpu);

[Severity: Low]
Does this code compile when CONFIG_SCHED_CLASS_EXT is enabled? Looking at struct
scx_dispatch_q defined in include/linux/sched/ext.h, it appears the correct
member name is pcpu_user, not pcpu. Using dsq->pcpu might result in an
unconditional build failure.

> +			struct rq *rq = cpu_rq(cpu);
> +
> +			guard(raw_spinlock_irqsave)(&rq->scx.deferred_reenq_lock);
> +			list_del_init(&pcpu->deferred_reenq_user.node);
> +		}
> +
>  		call_rcu(&dsq->rcu, free_dsq_rcufn);
> +	}
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261009220001.196762128-1-tj@kernel.org?part=1