[PATCH sched_ext/for-7.3-fixes] sched_ext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue

[PATCH sched_ext/for-7.3-fixes] sched_ext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue

[Tejun Heo]

A deferred reenqueue can read a freed user DSQ. The request stays on its
CPU's deferred list until run_deferred() takes it, and the RCU callback that
frees the DSQ assumes that the grace period has flushed it, so exit_dsq()
checks the per-CPU node without the deferred list lock. A grace period waits
for readers in flight, not for a pending run_deferred(). A run_deferred()
which starts after the grace period began can detach the request right
before the callback looks and then read the freed DSQ's id.

Cancel the pending requests before the grace period instead. The irq work
that frees the DSQ unlinks every CPU's request under the per-CPU deferred
list lock, and schedule_dsq_reenq() ignores a new request under the same
lock once the id is invalid. Only a run_deferred() that started before the
grace period can hold a request, and it runs with IRQs disabled, so the
grace period waits for it and nothing touches the DSQ after the callback.

Fixes: 84b1a0ea0b7c ("sched_ext: Implement scx_bpf_dsq_reenq() for user DSQs")
Cc: stable@vger.kernel.org # v7.1+
Reported-by: Hui Su <sh_def@163.com>
Link: https://lore.kernel.org/all/20261008024753.4096008-1-sh_def@163.com/
Signed-off-by: Tejun Heo <tj@kernel.org>
---
 kernel/sched/ext/ext.c |   28 +++++++++++++++++++++++++---
 1 file changed, 25 insertions(+), 3 deletions(-)

--- a/kernel/sched/ext/ext.c
+++ b/kernel/sched/ext/ext.c
@@ -1149,6 +1149,10 @@ void schedule_dsq_reenq(struct scx_sched
 
 			guard(raw_spinlock_irqsave)(&rq->scx.deferred_reenq_lock);
 
+			/* @dsq is being destroyed, see free_dsq_irq_workfn() */
+			if (unlikely(READ_ONCE(dsq->id) == SCX_DSQ_INVALID))
+				return;
+
 			if (list_empty(&dru->node))
 				list_move_tail(&dru->node, &rq->scx.deferred_reenq_users);
 			WRITE_ONCE(dru->flags, dru->flags | reenq_flags);
@@ -5171,8 +5175,8 @@ static void exit_dsq(struct scx_dispatch
 		struct rq *rq = cpu_rq(cpu);
 
 		/*
-		 * There must have been a RCU grace period since the last
-		 * insertion and @dsq should be off the deferred list by now.
+		 * free_dsq_irq_workfn() cancelled the reenqs before the grace
+		 * period and schedule_dsq_reenq() queues nothing after that.
 		 */
 		if (WARN_ON_ONCE(!list_empty(&dru->node))) {
 			guard(raw_spinlock_irqsave)(&rq->scx.deferred_reenq_lock);
@@ -5196,8 +5200,26 @@ static void free_dsq_irq_workfn(struct i
 	struct llist_node *to_free = llist_del_all(&dsqs_to_free);
 	struct scx_dispatch_q *dsq, *tmp_dsq;
 
-	llist_for_each_entry_safe(dsq, tmp_dsq, to_free, free_node)
+	llist_for_each_entry_safe(dsq, tmp_dsq, to_free, free_node) {
+		s32 cpu;
+
+		/*
+		 * Cancel pending reenqs. Only a run_deferred() that started
+		 * before the grace period can hold one, and it keeps IRQs off,
+		 * so the grace period waits for it. After this sweep,
+		 * schedule_dsq_reenq() sees the invalid id under the same lock
+		 * and queues nothing.
+		 */
+		for_each_possible_cpu(cpu) {
+			struct scx_dsq_pcpu *pcpu = per_cpu_ptr(dsq->pcpu, cpu);
+			struct rq *rq = cpu_rq(cpu);
+
+			guard(raw_spinlock_irqsave)(&rq->scx.deferred_reenq_lock);
+			list_del_init(&pcpu->deferred_reenq_user.node);
+		}
+
 		call_rcu(&dsq->rcu, free_dsq_rcufn);
+	}
 }
 
 static DEFINE_IRQ_WORK(free_dsq_irq_work, free_dsq_irq_workfn);

Re: [PATCH sched_ext/for-7.3-fixes] sched_ext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] sched/ext: build failure due to non-existent member pcpu in struct scx_dispatch_q
--

commit be226bed0faf80d9afdf2b8cee5244f38b4976cc
Author: Tejun Heo <tj@kernel.org>

sched_ext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue

This commit cancels pending requests before an RCU grace period when destroying
a user DSQ to prevent a use-after-free race condition with run_deferred().

Link: https://lore.kernel.org/all/20261008024753.4096008-1-sh_def@163.com/

> diff --git a/kernel/sched/ext/ext.c b/kernel/sched/ext/ext.c
> --- a/kernel/sched/ext/ext.c
> +++ b/kernel/sched/ext/ext.c

[ ... ]

> @@ -5656,8 +5660,26 @@ static void free_dsq_irq_workfn(struct irq_work *irq_work)
>  	struct llist_node *to_free = llist_del_all(&dsqs_to_free);
>  	struct scx_dispatch_q *dsq, *tmp_dsq;
>  
> -	llist_for_each_entry_safe(dsq, tmp_dsq, to_free, free_node)
> +	llist_for_each_entry_safe(dsq, tmp_dsq, to_free, free_node) {
> +		s32 cpu;
> +
> +		/*
> +		 * Cancel pending reenqs. Only a run_deferred() that started
> +		 * before the grace period can hold one, and it keeps IRQs off,
> +		 * so the grace period waits for it. After this sweep,
> +		 * schedule_dsq_reenq() sees the invalid id under the same lock
> +		 * and queues nothing.
> +		 */
> +		for_each_possible_cpu(cpu) {
> +			struct scx_dsq_pcpu *pcpu = per_cpu_ptr(dsq->pcpu, cpu);

[Severity: Low]
Does this code compile when CONFIG_SCHED_CLASS_EXT is enabled? Looking at struct
scx_dispatch_q defined in include/linux/sched/ext.h, it appears the correct
member name is pcpu_user, not pcpu. Using dsq->pcpu might result in an
unconditional build failure.

> +			struct rq *rq = cpu_rq(cpu);
> +
> +			guard(raw_spinlock_irqsave)(&rq->scx.deferred_reenq_lock);
> +			list_del_init(&pcpu->deferred_reenq_user.node);
> +		}
> +
>  		call_rcu(&dsq->rcu, free_dsq_rcufn);
> +	}
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261009220001.196762128-1-tj@kernel.org?part=1

Re: [PATCH sched_ext/for-7.3-fixes] sched_ext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue

[Tejun Heo]

Hello,

On Fri, Oct 09, 2026 at 10:09:59PM +0000, sashiko-bot@kernel.org wrote:
> Does this code compile when CONFIG_SCHED_CLASS_EXT is enabled? Looking at struct
> scx_dispatch_q defined in include/linux/sched/ext.h, it appears the correct
> member name is pcpu_user, not pcpu. Using dsq->pcpu might result in an
> unconditional build failure.

The patch is against sched_ext/for-7.3-fixes, where the member is still
pcpu. 92344fad5b54 ("sched_ext: Skip per-CPU data allocation for built-in
DSQs") renamed it to pcpu_user in for-7.4. The merge into for-7.4 will
carry the rename.

Thanks.

-- 
tejun

Re: [PATCH] sched_ext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue

[Hui Su]

Hi Tejun,

Tested on x86_64 KVM with KASAN; sched_ext selftests passed, and the targeted
DSQ lifetime test completed without the pre-fix slab-use-after-free.

Tested-by: Hui Su <sh_def@163.com>

Thanks,
Hui

Re: [PATCH sched_ext/for-7.3-fixes] sched_ext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue

[Tejun Heo]

Applied to sched_ext/for-7.3-fixes with the following tag updated:

    Reported-and-tested-by: Hui Su <sh_def@163.com>

Thanks.

--
tejun