From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 064364CA26C for ; Wed, 13 May 2026 16:33:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778690006; cv=none; b=mFii3GIwI8NSefqXk8PmrOVcxliYY9Nfy9/6rkwz0VPDyVSNApilTbHIplrzP9lcsS+f3fw7t1Rf0rG7PccBBkxZSao/8VICFbKC5vNayHIOJlgBJo3yUzeJ1Hjv52PiY6Kr2Ozsre7UDxGlc0cDK0ltMLYFyo+LBSH5Ip31mHw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778690006; c=relaxed/simple; bh=bvZ0cwvkIf/8jQ+cYAD7LyATgiCc5fcfAMcxNq26FOc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=r7WzXoVYLsYaiBm89MFAw0/OlraoTw69jdfW+chqdYaJ5ox4ImIHsU+QG/1OLrmrekT0IvTtMR+PCHOwe2EbqrxK9g0ZT8XF/BeR5gAIoLfkLBMKq23HtIZlVWF9bL4t9/YLy9ma4KqoTVkH7oCsa+hrXyHS1Pjm0VSVzp6lxbo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=H2ll1yJ+; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="H2ll1yJ+" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1A32DC19425; Wed, 13 May 2026 16:33:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1778690005; bh=bvZ0cwvkIf/8jQ+cYAD7LyATgiCc5fcfAMcxNq26FOc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=H2ll1yJ+0dez6Y5moZwhgQzwmAOahvCduWDg7UMHVrIiVVSzlTGvDt1gBj88gPKI2 ihxlFCkKueBvvU6SNQMRfTfxotThEKbVvw/+CK1fpNpmth758SlH1FV79cWVwncWgU 5+guEPrMztB0Rg1R35TPCm271eN+LTOeetf/Zz/I8ZtKpqjwHhjz2CyqWp2LdvYL9n SF7XuZhBlof4cWxKT4OxDTyYDF/euTX4RgOJc71xcifSP8zuUAo4JGckfvxcNPK8Ya gWtILk8G8FrOYoKgiRWg2zGcfyKXot9DUoyZqn+zqkA3yJU2oLShnoYZs+2ck7crGk ZgHUkAOLyoGjA== From: Sasha Levin To: stable@vger.kernel.org Cc: Tejun Heo , Chris Mason , Andrea Righi , Sasha Levin Subject: [PATCH 6.18.y 2/2] sched_ext: Read scx_root under scx_cgroup_ops_rwsem in cgroup setters Date: Wed, 13 May 2026 12:33:22 -0400 Message-ID: <20260513163322.3807202-2-sashal@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260513163322.3807202-1-sashal@kernel.org> References: <2026051219-oval-unbalance-97f6@gregkh> <20260513163322.3807202-1-sashal@kernel.org> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Tejun Heo [ Upstream commit 80afd4c84bc8f5e80145ce35279f5ce53f6043db ] scx_group_set_{weight,idle,bandwidth}() cache scx_root before acquiring scx_cgroup_ops_rwsem, so the pointer can be stale by the time the op runs. If the loaded scheduler is disabled and freed (via RCU work) and another is enabled between the naked load and the rwsem acquire, the reader sees scx_cgroup_enabled=true (the new scheduler's) but dereferences the freed one - UAF on SCX_HAS_OP(sch, ...) / SCX_CALL_OP(sch, ...). scx_cgroup_enabled is toggled only under scx_cgroup_ops_rwsem write (scx_cgroup_{init,exit}), so reading scx_root inside the rwsem read section correlates @sch with the enabled snapshot. Fixes: a5bd6ba30b33 ("sched_ext: Use cgroup_lock/unlock() to synchronize against cgroup operations") Cc: stable@vger.kernel.org # v6.18+ Reported-by: Chris Mason Signed-off-by: Tejun Heo Reviewed-by: Andrea Righi Signed-off-by: Sasha Levin --- kernel/sched/ext.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/kernel/sched/ext.c b/kernel/sched/ext.c index 423098966a291..177bbf31116d0 100644 --- a/kernel/sched/ext.c +++ b/kernel/sched/ext.c @@ -3251,9 +3251,10 @@ void scx_cgroup_cancel_attach(struct cgroup_taskset *tset) void scx_group_set_weight(struct task_group *tg, unsigned long weight) { - struct scx_sched *sch = scx_root; + struct scx_sched *sch; percpu_down_read(&scx_cgroup_ops_rwsem); + sch = scx_root; if (scx_cgroup_enabled && SCX_HAS_OP(sch, cgroup_set_weight) && tg->scx.weight != weight) @@ -3267,9 +3268,10 @@ void scx_group_set_weight(struct task_group *tg, unsigned long weight) void scx_group_set_idle(struct task_group *tg, bool idle) { - struct scx_sched *sch = scx_root; + struct scx_sched *sch; percpu_down_read(&scx_cgroup_ops_rwsem); + sch = scx_root; if (scx_cgroup_enabled && SCX_HAS_OP(sch, cgroup_set_idle)) SCX_CALL_OP(sch, SCX_KF_UNLOCKED, cgroup_set_idle, NULL, @@ -3284,9 +3286,10 @@ void scx_group_set_idle(struct task_group *tg, bool idle) void scx_group_set_bandwidth(struct task_group *tg, u64 period_us, u64 quota_us, u64 burst_us) { - struct scx_sched *sch = scx_root; + struct scx_sched *sch; percpu_down_read(&scx_cgroup_ops_rwsem); + sch = scx_root; if (scx_cgroup_enabled && SCX_HAS_OP(sch, cgroup_set_bandwidth) && (tg->scx.bw_period_us != period_us || -- 2.53.0