Re: [PATCH 2/6] sched_ext: Inline scx_init_task() and move RESET_RUNNABLE_AT into scx_set_task_state()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Use-After-Free (UAF) of task_struct fields `p->comm` and `p->pid` in the error path of `scx_root_enable_workfn()`.
--

commit ff748fbf4ba914d4e370692e8c52959bf3619890
Author: Tejun Heo <tj@kernel.org>

sched_ext: Inline scx_init_task() and move RESET_RUNNABLE_AT into scx_set_task_state()

This commit prepares for the SCX_TASK_INIT_BEGIN/DEAD work by collapsing the
scx_init_task() helper and moving the SCX_TASK_RESET_RUNNABLE_AT setting
into scx_set_task_state(). It also inlines scx_init_task() into scx_fork()
and scx_root_enable_workfn(), dropping the helper.

> diff --git a/kernel/sched/ext.c b/kernel/sched/ext.c
> --- a/kernel/sched/ext.c
> +++ b/kernel/sched/ext.c

[ ... ]

> @@ -6884,8 +6870,8 @@ static void scx_root_enable_workfn(struct kthread_work *work)
>  
>  		scx_task_iter_unlock(&sti);
>  
> -		ret = scx_init_task(sch, p, false);
> -		if (ret) {
> +		ret = __scx_init_task(sch, p, false);
> +		if (unlikely(ret)) {
>  			put_task_struct(p);
>  			scx_task_iter_stop(&sti);
>  			scx_error(sch, "ops.init_task() failed (%d) for %s[%d]",
>  				  ret, p->comm, p->pid);

This isn't a bug introduced by this commit, but could this lead to a
use-after-free of the task struct?

If put_task_struct(p) drops the last reference (for example, if the task is
concurrently exiting), it will schedule the task struct for RCU-delayed
freeing.

Immediately after, scx_task_iter_stop() releases the task iterator locks,
which can re-enable preemption and interrupts. Since the thread holds
sleeping locks, an RCU grace period could potentially elapse before execution
resumes.

If that happens, accessing p->comm and p->pid in scx_error() would
dereference freed memory.

Should put_task_struct(p) be moved after scx_error() to prevent this?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260510074113.2049514-1-tj@kernel.org?part=2