Re: [PATCH 6/6] sched_ext: Handle SCX_TASK_NONE in disable/switched_from paths

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] The newly added early return in `scx_disable_and_exit_task()` skips clearing the `p->scx.sched` pointer for tasks in the `SCX_TASK_NONE` state, creating a deterministic Use-After-Free (UAF) vulnerability.
--

commit edcdc86f04b3e413339b79eef811a59560178144
Author: Tejun Heo <tj@kernel.org>

sched_ext: Handle SCX_TASK_NONE in disable/switched_from paths

This commit adds early returns for tasks in the SCX_TASK_NONE state
during scx_disable_and_exit_task() and switched_from_scx(). It prevents
writing state=READY on already detached tasks and clobbering the parent
scheduler left by scx_fail_parent().

> diff --git a/kernel/sched/ext.c b/kernel/sched/ext.c
> index 08e7dad437b32..eba25eb4e0543 100644
> --- a/kernel/sched/ext.c
> +++ b/kernel/sched/ext.c
> @@ -3704,6 +3704,15 @@ static void scx_sub_init_cancel_task(struct scx_sched *sch, struct task_struct *
>  static void scx_disable_and_exit_task(struct scx_sched *sch,
>  				      struct task_struct *p)
>  {
> +	/*
> +	 * %NONE means @p is already detached at the SCX level (e.g. handed
> +	 * back to the parent by scx_fail_parent() with no init to undo).
> +	 * Skip to avoid clobbering scx_task_sched() and writing %NONE again
> +	 * on a state that's already %NONE.
> +	 */
> +	if (scx_get_task_state(p) == SCX_TASK_NONE)
> +		return;
> +

Does this early return leave a dangling pointer in p->scx.sched?

When scx_fail_parent() hands a task back to the parent scheduler, it
transitions the task to SCX_TASK_NONE and sets p->scx.sched = parent.

If the parent scheduler is subsequently torn down, it iterates over all
tasks to detach them. Because the state is SCX_TASK_NONE, this early return
bypasses the trailing scx_set_task_sched(p, NULL) cleanup step at the end of
this function.

The task is migrated back to CFS but retains a dangling p->scx.sched
pointer to the freed parent scheduler. If /proc/self/sched is read
afterward, print_scx_info() retrieves this pointer via
scx_task_sched_rcu(p) and dereferences it to print sch->ops.name, causing a
use-after-free read.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260510074113.2049514-1-tj@kernel.org?part=6