Re: [PATCH 3/3] tools/sched_ext: scx_pair: Verify task cgroup before dispatch

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] sched_ext: fatal abort in scx_pair due to scx_kf_arg_task_ok() violation
--

commit 79e8ca61bf0fbb13b0ca39d2236cec7b65f02134
Author: Wanwu Li <liwanwu@kylinos.cn>

tools/sched_ext: scx_pair: Verify task cgroup before dispatch

This commit modifies try_dispatch() to read the task's current cgroup after
looking it up from its pid. This ensures the task hasn't migrated to another
cgroup between enqueue and dispatch, dropping tasks that have migrated to
avoid dispatching them under the wrong cgroup context.

> diff --git a/tools/sched_ext/scx_pair.bpf.c b/tools/sched_ext/scx_pair.bpf.c
> index 906bb11d678f7..d29bb9fc6c92e 100644
> --- a/tools/sched_ext/scx_pair.bpf.c
> +++ b/tools/sched_ext/scx_pair.bpf.c
> @@ -519,6 +519,25 @@ static int try_dispatch(s32 cpu)
>  
>  	p = bpf_task_from_pid(pid);
>  	if (p) {
> +		struct cgroup *task_cgrp;
> +		u64 task_cgid;
> +
> +		/*
> +		 * Without a .dequeue callback, a task that migrated to
> +		 * another cgroup after being enqueued leaves a stale pid
> +		 * behind. Dispatching it here would run it under the wrong
> +		 * cgroup. Drop it and retry.
> +		 */
> +		task_cgrp = scx_bpf_task_cgroup(p);

[Severity: High]
Will this cause a scheduler abort?

Looking at the kfunc implementation, scx_bpf_task_cgroup() internally
validates the task using scx_kf_arg_task_ok(), which requires that the
passed task matches current->scx.kf_tasks[0] (the task currently being
operated on by a task-specific SCX hook).

Because try_dispatch() is invoked from the .dispatch scheduler hook
(pair_dispatch) via SCX_CALL_OP() rather than SCX_CALL_OP_TASK(),
kf_tasks[0] is not populated and remains NULL during dispatch.

Since the looked-up task p is not NULL, won't scx_kf_arg_task_ok()
unconditionally fail and trigger scx_error(), causing a fallback to CFS
on the very first task dispatch?

> +		task_cgid = task_cgrp->kn->id;
> +		bpf_cgroup_release(task_cgrp);
> +
> +		if (task_cgid != cgid) {
> +			bpf_task_release(p);
> +			__sync_fetch_and_add(&nr_missing, 1);
> +			return -EAGAIN;
> +		}
> +
>  		__sync_fetch_and_add(&nr_dispatched, 1);
>  		scx_bpf_dsq_insert(p, SCX_DSQ_GLOBAL, SCX_SLICE_DFL, 0);
>  		bpf_task_release(p);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260924143659.268595-1-liwanwu@kylinos.cn?part=3