Re: [PATCH v2] sched_ext: Reset cpuperf_target when a sub loses SCX_CAP_PERF or dies

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] bpf: missing dying scheduler check in scx_bpf_cpuperf_set()
--

commit 44646e483943d4ebcaaab6b95abd7f0ef7f1bd41
Author: Tao Cui <cuitao@kylinos.cn>

sched_ext: Reset cpuperf_target when a sub loses SCX_CAP_PERF or dies

This commit resets the cpuperf_target of a sub-scheduler when it loses
SCX_CAP_PERF or dies. It adds a dying scheduler check to scx_bpf_cidperf_set()
to prevent late writes from polluting the state.

Link: https://lore.kernel.org/sched-ext/20261004012721.615419-1-cui.tao@linux.dev/

> diff --git a/kernel/sched/ext/ext.c b/kernel/sched/ext/ext.c
> index 0917f05263a37..8b661e9bdf6bb 100644
> --- a/kernel/sched/ext/ext.c
> +++ b/kernel/sched/ext/ext.c
[ ... ]
> @@ -10958,6 +10960,15 @@ __bpf_kfunc s32 scx_bpf_cidperf_set(s32 cid, u32 perf,
>  	if (!scx_kf_allowed_ctx(sch))
>  		return -EDEADLK;
>  
> +	/*
> +	 * Reject writes from a dying scheduler. Its targets have been or
> +	 * will be swept back to the neutral base, but ops.exit() and any
> +	 * late stragglers still run after that sweep - a write there would
> +	 * land after the final reset with nothing left to clean it up.
> +	 */
> +	if (unlikely(atomic_read(&sch->exit_kind) != SCX_EXIT_NONE))
> +		return -EACCES;
> +

[Severity: High]
This correctly prevents a dying scheduler from repolluting targets via the
CID-addressed variant, but should the same check be applied to the
CPU-addressed variant, scx_bpf_cpuperf_set(), defined just above this
function?

Looking at scx_bpf_cpuperf_set() in kernel/sched/ext/ext.c:

    if (!scx_kf_allowed_ctx(sch))
            return;

    scx_cpuperf_set(sch, cpu, perf);

If a dying sub-scheduler executes BPF timers or tracers after the final
cpuperf sweep in scx_sub_disable() but before sch->dead is set, could it use
scx_bpf_cpuperf_set() to bypass this safety gate and repollute
rq->scx.cpuperf_target?

Since the root scheduler remains running, would schedutil permanently consume
this stale low-frequency target and pin the CPU?

>  	cpu = scx_cid_to_cpu(sch, cid);
>  	if (cpu < 0)
>  		return cpu;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261006142834.2815197-1-cui.tao@linux.dev?part=1