[PATCH bpf-next] sched_ext: Reset task fields on exit of an SCX_TASK_READY task

[PATCH bpf-next] sched_ext: Reset task fields on exit of an SCX_TASK_READY task

[Rahad Bhuiya]

Commit a298fd5f4ee8 ("sched_ext: Fix use-after-free of a NONE rescuee
leaving its sched while running") moved the reset of SCX-managed fields
out of scx_disable_task() into scx_reset_task_fields() so that it can be
invoked on every path where a task leaves its scheduler's control,
including tasks in SCX_TASK_NONE.

However, in __scx_disable_and_exit_task(), an exiting task in state
SCX_TASK_READY (e.g., a forked task that was initialized via
ops.init_task() but never enabled under an ext_sched_class before exiting,
or a disabled task) currently breaks out of the state switch without
calling scx_reset_task_fields().

Consequently, its managed fields (vtime, slice, reenqueue flags, and
watchdog runnable_at reset) are not reset, violating the invariant that a
task leaving its scheduler's control starts clean.

Call scx_reset_task_fields() in the SCX_TASK_READY case of
__scx_disable_and_exit_task() to ensure consistent cleanup across all exit
paths.

Fixes: a298fd5f4ee8 ("sched_ext: Fix use-after-free of a NONE rescuee leaving its sched while running")
Signed-off-by: Rahad Bhuiya <rahadbhuiya2021@gmail.com>
---
 kernel/sched/ext/ext.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/kernel/sched/ext/ext.c b/kernel/sched/ext/ext.c
index f74ffb3b1aca..b57a7989f304 100644
--- a/kernel/sched/ext/ext.c
+++ b/kernel/sched/ext/ext.c
@@ -4728,6 +4728,7 @@ void __scx_disable_and_exit_task(struct scx_sched *sch, struct task_struct *p)
 		args.cancelled = true;
 		break;
 	case SCX_TASK_READY:
+		scx_reset_task_fields(task_rq(p), p);
 		break;
 	case SCX_TASK_ENABLED:
 		scx_disable_task(sch, p);
-- 
2.55.0.windows.3

Re: [PATCH bpf-next] sched_ext: Reset task fields on exit of an SCX_TASK_READY task

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [High] sched_ext: call to undeclared scx_reset_task_fields() breaks
  build
--

commit 64db5de46ee85990aea72e2451a03a9902ada739
Author: Rahad Bhuiya <rahadbhuiya2021@gmail.com>

sched_ext: Reset task fields on exit of an SCX_TASK_READY task

This commit calls scx_reset_task_fields() in __scx_disable_and_exit_task()
when a task is in the SCX_TASK_READY state.

> diff --git a/kernel/sched/ext/ext.c b/kernel/sched/ext/ext.c
> index 0403c46342813..1cb1532512e6a 100644
> --- a/kernel/sched/ext/ext.c
> +++ b/kernel/sched/ext/ext.c
> @@ -4014,6 +4014,7 @@ void __scx_disable_and_exit_task(struct scx_sched *sch, struct task_struct *p)
>  		args.cancelled = true;
>  		break;
>  	case SCX_TASK_READY:
> +		scx_reset_task_fields(task_rq(p), p);

[Severity: High]
Does calling scx_reset_task_fields() here break the build when
CONFIG_SCHED_CLASS_EXT is enabled?  Commit a298fd5f4ee8 ("sched_ext: Fix
use-after-free of a NONE rescuee leaving its sched while running") is not
present in this tree, so scx_disable_task() still resets task fields inline
and scx_reset_task_fields() is neither declared nor defined.

Even on top of commit a298fd5f4ee8 ("sched_ext: Fix use-after-free of a
NONE rescuee leaving its sched while running"), a task in SCX_TASK_READY is
not under a scheduler's active runtime control (any transition from
SCX_TASK_ENABLED via switched_from_scx() already ran scx_disable_task()),
and calling scx_reset_task_fields() during scx_rehome_task() would zero the
default initial p->scx.slice set by init_scx_entity() or scx_enable().

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261106142818.1475-1-rahadbhuiya2021@gmail.com?part=1

Re: [PATCH bpf-next] sched_ext: Reset task fields on exit of an SCX_TASK_READY task

[Tejun Heo]

Hello, Rahad.

On Fri, Nov 06, 2026 at 08:28:18PM +0600, Rahad Bhuiya wrote:
> However, in __scx_disable_and_exit_task(), an exiting task in state
> SCX_TASK_READY (e.g., a forked task that was initialized via
> ops.init_task() but never enabled under an ext_sched_class before exiting,
> or a disabled task) currently breaks out of the state switch without
> calling scx_reset_task_fields().

Neither example has anything to reset. A forked task which exits while
READY goes through sched_ext_dead() and is freed. A task disabled from
ENABLED is already reset: both callers of scx_disable_task(), the
ENABLED case here and switched_from_scx(), call scx_reset_task_fields()
right after it.

A READY task is on a sched but outside the ext class. RT and DL tasks
are always in that state, and so are non-SCHED_EXT tasks under a partial
switch. The sched's BPF code can still write such a task's dsq_vtime and
slice, and because the READY exit doesn't reset them, they carry over
when the task moves to another sched.

For example, an RT task in a cgroup owned by sub-sched A gets its
dsq_vtime set by A's ops.cgroup_move(), as scx_flatcg does. If the task
is then moved to a cgroup owned by sub-sched B and later switches to
SCHED_NORMAL, B's ops.enable() sees the dsq_vtime from A's clock.

Can you rewrite the description around that case?

> Fixes: a298fd5f4ee8 ("sched_ext: Fix use-after-free of a NONE rescuee leaving its sched while running")

a298fd5f4ee8 didn't change the READY case. It was a bare break before
and after. The gap goes back to 5771e79e461e ("sched_ext: Reset
dsq_vtime and slice when a task leaves SCX"), which put the reset only
on the ENABLED path, so that'd be the one to point at if the patch keeps
a Fixes tag.

sched_ext patches go through the sched_ext tree, not bpf-next. Can you
repost with the above updated?

Thanks.

--
tejun

[PATCH v2] sched_ext: Reset task fields on exit of an SCX_TASK_READY task

[Rahad Bhuiya]

Tasks in SCX_TASK_READY are attached to a scheduler but outside the ext
class, such as RT/DL tasks, or non-SCHED_EXT tasks under a partial switch.
The scheduler's BPF code can still update their dsq_vtime and slice (for
instance, via ops.cgroup_move() as done by scx_flatcg).

Because __scx_disable_and_exit_task() currently breaks out of the state
switch for SCX_TASK_READY without calling scx_reset_task_fields(), these
fields are not cleared when the task leaves the scheduler. If the task is
subsequently moved to another cgroup/sub-scheduler and later switches to
SCHED_NORMAL, the new scheduler's ops.enable() sees stale dsq_vtime from
the previous scheduler's clock.

Call scx_reset_task_fields() in the SCX_TASK_READY case of
__scx_disable_and_exit_task() to ensure SCX-managed fields are properly
reset when leaving the scheduler.

Fixes: 5771e79e461e ("sched_ext: Reset dsq_vtime and slice when a task leaves SCX")
Signed-off-by: Rahad Bhuiya <rahadbhuiya2021@gmail.com>
---
v2:
- Rewrote the commit description to describe the cgroup sub-sched / RT task
  migration case (per Tejun Heo).
- Updated Fixes: tag to 5771e79e461e ("sched_ext: Reset dsq_vtime and slice
  when a task leaves SCX").
- Targeted sched_ext tree instead of bpf-next.

 kernel/sched/ext/ext.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/kernel/sched/ext/ext.c b/kernel/sched/ext/ext.c
index f74ffb3b1aca..b57a7989f304 100644
--- a/kernel/sched/ext/ext.c
+++ b/kernel/sched/ext/ext.c
@@ -4728,6 +4728,7 @@ void __scx_disable_and_exit_task(struct scx_sched *sch, struct task_struct *p)
 		args.cancelled = true;
 		break;
 	case SCX_TASK_READY:
+		scx_reset_task_fields(task_rq(p), p);
 		break;
 	case SCX_TASK_ENABLED:
 		scx_disable_task(sch, p);
-- 
2.55.0.windows.3

Re: [PATCH v2] sched_ext: Reset task fields on exit of an SCX_TASK_READY task

[Tejun Heo]

Applied to sched_ext/for-7.4-fixes.

Thanks.

--
tejun