Re: [PATCH] sched_ext: Close the pre-enable ops error claim window

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Concurrent calls to scx_root_disable() on the same scheduler cause a double teardown due to fall-throughs on SCX_DISABLING and SCX_DISABLED.
--

commit dd97abeb536b6afa1a46d2a0b2de7e7eaddfef0a
Author: fangqiurong <fangqiurong@kylinos.cn>

sched_ext: Close the pre-enable ops error claim window

This commit addresses a race window where scx_alloc_and_add_sched()
publishes ops->priv before transitioning to SCX_ENABLING. It moves the state
transition before the allocation and adjusts the early exit logic in
scx_root_disable() to prevent a teardown shortcut from racing with the
enable workfn.

> diff --git a/kernel/sched/ext/ext.c b/kernel/sched/ext/ext.c
> --- a/kernel/sched/ext/ext.c
> +++ b/kernel/sched/ext/ext.c

[ ... ]

> @@ -6395,8 +6395,9 @@ static void scx_root_disable(struct scx_sched *sch)
>  	case SCX_DISABLED:
>  		pr_warn("sched_ext: ops error detected without ops (%s)\n",
>  			sch->exit_info->msg);
> -		WARN_ON_ONCE(scx_set_enable_state(SCX_DISABLED) != SCX_DISABLING);
> -		goto done;
> +		if (scx_tryset_enable_state(SCX_DISABLED, SCX_DISABLING))
> +			goto done;
> +		break;

[Severity: High]
If two threads concurrently call scx_root_disable() (e.g., a SysRq disable
and a BPF error triggering scx_disable_workfn), both will serialize on
scx_enable_mutex.

For the thread that arrives second, if scx_set_enable_state() returns
SCX_DISABLED and scx_tryset_enable_state() fails, the newly added break
statement will cause it to fall through the switch block instead of going to
done.

Similarly, if scx_set_enable_state() returns SCX_DISABLING, the adjacent
case block logs a warning and also breaks out of the switch.

In both cases, does this allow the second thread to bypass the early exit,
acquire scx_enable_mutex, and execute the full teardown sequence again on an
already disabled scheduler?

Could this result in memory corruption from double frees (such as calling
rhashtable_free_and_destroy() on scx_tid_hash again) and duplicate calls to
the BPF program's exit callback?

>  	default:
>  		break;
>  	}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260910084533.2420199-1-fangqiurong@kylinos.cn?part=1