[PATCH bpf-next 0/2] sched_ext: Mark scx_bpf_cpu_rq() nullable

[PATCH bpf-next 0/2] sched_ext: Mark scx_bpf_cpu_rq() nullable

[Nuoqi Gui]

scx_bpf_cpu_rq() can return NULL for invalid CPU input or when no SCX
scheduler is active, but its kfunc registration does not advertise the
nullable return to the verifier.

Add KF_RET_NULL to scx_bpf_cpu_rq(), matching the nullable metadata already
present on neighboring SCX accessors, and add a sched_ext selftest that rejects
an unchecked direct runqueue field read.

This fixes a regression introduced by 6203ef73fa5c ("sched/ext: Add BPF
function to fetch rq").

Signed-off-by: Nuoqi Gui <gnq25@mails.tsinghua.edu.cn>
---
Nuoqi Gui (2):
      sched_ext: Mark scx_bpf_cpu_rq() as nullable
      selftests/sched_ext: Cover scx_bpf_cpu_rq() null return

 kernel/sched/ext.c                                 |  2 +-
 tools/testing/selftests/sched_ext/Makefile         |  1 +
 .../selftests/sched_ext/cpu_rq_ret_null.bpf.c      | 27 +++++++++++++++
 .../testing/selftests/sched_ext/cpu_rq_ret_null.c  | 38 ++++++++++++++++++++++
 4 files changed, 67 insertions(+), 1 deletion(-)
---
base-commit: e4287bf34f97a88c7d9322f5bde828724c073a6b
change-id: 20260617-f01-14-scx-cpu-rq-ret-null-2e79535acd57

Best regards,
--  
Nuoqi Gui <gnq25@mails.tsinghua.edu.cn>

[PATCH bpf-next 1/2] sched_ext: Mark scx_bpf_cpu_rq() as nullable

[Nuoqi Gui]

scx_bpf_cpu_rq() can return NULL when the calling program is not attached to
an active SCX scheduler or when the requested CPU is invalid. Its kfunc
registration currently advertises only KF_IMPLICIT_ARGS, so the verifier does
not mark the return as PTR_MAYBE_NULL.

Add KF_RET_NULL to the registration, matching scx_bpf_locked_rq() and
scx_bpf_cpu_curr(), so BPF programs must check the returned runqueue pointer
before dereferencing it.

Fixes: 6203ef73fa5c ("sched/ext: Add BPF function to fetch rq")
Signed-off-by: Nuoqi Gui <gnq25@mails.tsinghua.edu.cn>
---
 kernel/sched/ext.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/sched/ext.c b/kernel/sched/ext.c
index 65631e577ee9..dbe1fe1ac465 100644
--- a/kernel/sched/ext.c
+++ b/kernel/sched/ext.c
@@ -9787,7 +9787,7 @@ BTF_ID_FLAGS(func, scx_bpf_get_online_cpumask, KF_ACQUIRE)
 BTF_ID_FLAGS(func, scx_bpf_put_cpumask, KF_RELEASE)
 BTF_ID_FLAGS(func, scx_bpf_task_running, KF_RCU)
 BTF_ID_FLAGS(func, scx_bpf_task_cpu, KF_RCU)
-BTF_ID_FLAGS(func, scx_bpf_cpu_rq, KF_IMPLICIT_ARGS)
+BTF_ID_FLAGS(func, scx_bpf_cpu_rq, KF_IMPLICIT_ARGS | KF_RET_NULL)
 BTF_ID_FLAGS(func, scx_bpf_locked_rq, KF_IMPLICIT_ARGS | KF_RET_NULL)
 BTF_ID_FLAGS(func, scx_bpf_cpu_curr, KF_IMPLICIT_ARGS | KF_RET_NULL | KF_RCU_PROTECTED)
 BTF_ID_FLAGS(func, scx_bpf_now)

-- 
2.34.1

[PATCH bpf-next 2/2] selftests/sched_ext: Cover scx_bpf_cpu_rq() null return

[Nuoqi Gui]

Add a sched_ext negative-load test that calls scx_bpf_cpu_rq(-1) and then
immediately reads rq->nr_running. The verifier should reject the program
because scx_bpf_cpu_rq() may return NULL.

This guards the KF_RET_NULL metadata for scx_bpf_cpu_rq().

Signed-off-by: Nuoqi Gui <gnq25@mails.tsinghua.edu.cn>
---
 tools/testing/selftests/sched_ext/Makefile         |  1 +
 .../selftests/sched_ext/cpu_rq_ret_null.bpf.c      | 27 +++++++++++++++
 .../testing/selftests/sched_ext/cpu_rq_ret_null.c  | 38 ++++++++++++++++++++++
 3 files changed, 66 insertions(+)

diff --git a/tools/testing/selftests/sched_ext/Makefile b/tools/testing/selftests/sched_ext/Makefile
index 5d2dffca0e91..15cedcf56a49 100644
--- a/tools/testing/selftests/sched_ext/Makefile
+++ b/tools/testing/selftests/sched_ext/Makefile
@@ -174,6 +174,7 @@ auto-test-targets :=			\
 	init_enable_count		\
 	maximal				\
 	maybe_null			\
+	cpu_rq_ret_null		\
 	minimal				\
 	non_scx_kfunc_deny		\
 	numa				\
diff --git a/tools/testing/selftests/sched_ext/cpu_rq_ret_null.bpf.c b/tools/testing/selftests/sched_ext/cpu_rq_ret_null.bpf.c
new file mode 100644
index 000000000000..d08f0b582542
--- /dev/null
+++ b/tools/testing/selftests/sched_ext/cpu_rq_ret_null.bpf.c
@@ -0,0 +1,27 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2026 Nuoqi Gui
+ */
+#include <scx/common.bpf.h>
+
+char _license[] SEC("license") = "GPL";
+
+u32 nr_running;
+
+void BPF_STRUCT_OPS(cpu_rq_ret_null_enable, struct task_struct *p)
+{}
+
+void BPF_STRUCT_OPS(cpu_rq_ret_null_dispatch, s32 cpu, struct task_struct *p)
+{
+	struct rq *rq;
+
+	rq = scx_bpf_cpu_rq(-1);
+	nr_running = rq->nr_running;
+}
+
+SEC(".struct_ops.link")
+struct sched_ext_ops cpu_rq_ret_null = {
+	.dispatch		= (void *)cpu_rq_ret_null_dispatch,
+	.enable			= (void *)cpu_rq_ret_null_enable,
+	.name			= "cpu_rq_ret_null",
+};
diff --git a/tools/testing/selftests/sched_ext/cpu_rq_ret_null.c b/tools/testing/selftests/sched_ext/cpu_rq_ret_null.c
new file mode 100644
index 000000000000..bd82c310ad7a
--- /dev/null
+++ b/tools/testing/selftests/sched_ext/cpu_rq_ret_null.c
@@ -0,0 +1,38 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2026 Nuoqi Gui
+ */
+#include <bpf/bpf.h>
+#include <scx/common.h>
+#include "cpu_rq_ret_null.bpf.skel.h"
+#include "scx_test.h"
+
+static enum scx_test_status run(void *ctx)
+{
+	struct cpu_rq_ret_null *skel;
+	int err;
+
+	skel = cpu_rq_ret_null__open();
+	if (!skel) {
+		SCX_ERR("Failed to open skel");
+		return SCX_TEST_FAIL;
+	}
+
+	err = cpu_rq_ret_null__load(skel);
+	cpu_rq_ret_null__destroy(skel);
+
+	if (!err) {
+		SCX_ERR("scx_bpf_cpu_rq() direct dereference loaded");
+		return SCX_TEST_FAIL;
+	}
+
+	return SCX_TEST_PASS;
+}
+
+struct scx_test cpu_rq_ret_null = {
+	.name = "cpu_rq_ret_null",
+	.description = "Verify that scx_bpf_cpu_rq() returns a nullable pointer",
+	.run = run,
+};
+
+REGISTER_SCX_TEST(&cpu_rq_ret_null)

-- 
2.34.1

Re: [PATCH bpf-next 0/2] sched_ext: Mark scx_bpf_cpu_rq() nullable

[Christian Loehle]

On 6/19/26 15:45, Nuoqi Gui wrote:
> scx_bpf_cpu_rq() can return NULL for invalid CPU input or when no SCX
> scheduler is active, but its kfunc registration does not advertise the
> nullable return to the verifier.
> 
> Add KF_RET_NULL to scx_bpf_cpu_rq(), matching the nullable metadata already
> present on neighboring SCX accessors, and add a sched_ext selftest that rejects
> an unchecked direct runqueue field read.
> 

See 5c48d88fe004 ("sched_ext: deprecation warn for scx_bpf_cpu_rq()")
I guess I can send a patch to remove the function, it's been a while.

> This fixes a regression introduced by 6203ef73fa5c ("sched/ext: Add BPF
> function to fetch rq").

How so?

> 
> Signed-off-by: Nuoqi Gui <gnq25@mails.tsinghua.edu.cn>
> ---
> Nuoqi Gui (2):
>       sched_ext: Mark scx_bpf_cpu_rq() as nullable
>       selftests/sched_ext: Cover scx_bpf_cpu_rq() null return
> 
>  kernel/sched/ext.c                                 |  2 +-
>  tools/testing/selftests/sched_ext/Makefile         |  1 +
>  .../selftests/sched_ext/cpu_rq_ret_null.bpf.c      | 27 +++++++++++++++
>  .../testing/selftests/sched_ext/cpu_rq_ret_null.c  | 38 ++++++++++++++++++++++
>  4 files changed, 67 insertions(+), 1 deletion(-)
> ---
> base-commit: e4287bf34f97a88c7d9322f5bde828724c073a6b
> change-id: 20260617-f01-14-scx-cpu-rq-ret-null-2e79535acd57
> 
> Best regards,
> --  
> Nuoqi Gui <gnq25@mails.tsinghua.edu.cn>
> 
> 

Re: Re: [PATCH bpf-next 0/2] sched_ext: Mark scx_bpf_cpu_rq() nullable

[Nuoqi Gui]

> -----Original Messages-----
> From: "Christian Loehle" <christian.loehle@arm.com>
> Send time:Friday, 19/06/2026 23:31:59
> To: "Nuoqi Gui" <gnq25@mails.tsinghua.edu.cn>, "Tejun Heo" <tj@kernel.org>, "David Vernet" <void@manifault.com>, "Alexei Starovoitov" <ast@kernel.org>, "Daniel Borkmann" <daniel@iogearbox.net>, "Andrii Nakryiko" <andrii@kernel.org>
> Cc: "Andrea Righi" <arighi@nvidia.com>, "Changwoo Min" <changwoo@igalia.com>, "Shuah Khan" <shuah@kernel.org>, sched-ext@lists.linux.dev, bpf@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org
> Subject: Re: [PATCH bpf-next 0/2] sched_ext: Mark scx_bpf_cpu_rq() nullable
> 
> On 6/19/26 15:45, Nuoqi Gui wrote:
> > scx_bpf_cpu_rq() can return NULL for invalid CPU input or when no SCX
> > scheduler is active, but its kfunc registration does not advertise the
> > nullable return to the verifier.
> > 
> > Add KF_RET_NULL to scx_bpf_cpu_rq(), matching the nullable metadata already
> > present on neighboring SCX accessors, and add a sched_ext selftest that rejects
> > an unchecked direct runqueue field read.
> > 
> 
> See 5c48d88fe004 ("sched_ext: deprecation warn for scx_bpf_cpu_rq()")
> I guess I can send a patch to remove the function, it's been a while.
> 
> > This fixes a regression introduced by 6203ef73fa5c ("sched/ext: Add BPF
> > function to fetch rq").
> 
> How so?
> 
> > 
> > Signed-off-by: Nuoqi Gui <gnq25@mails.tsinghua.edu.cn>
> > ---
> > Nuoqi Gui (2):
> >       sched_ext: Mark scx_bpf_cpu_rq() as nullable
> >       selftests/sched_ext: Cover scx_bpf_cpu_rq() null return
> > 
> >  kernel/sched/ext.c                                 |  2 +-
> >  tools/testing/selftests/sched_ext/Makefile         |  1 +
> >  .../selftests/sched_ext/cpu_rq_ret_null.bpf.c      | 27 +++++++++++++++
> >  .../testing/selftests/sched_ext/cpu_rq_ret_null.c  | 38 ++++++++++++++++++++++
> >  4 files changed, 67 insertions(+), 1 deletion(-)
> > ---
> > base-commit: e4287bf34f97a88c7d9322f5bde828724c073a6b
> > change-id: 20260617-f01-14-scx-cpu-rq-ret-null-2e79535acd57
> > 
> > Best regards,
> > --  
> > Nuoqi Gui <gnq25@mails.tsinghua.edu.cn>
> > 
> > 

Thanks, you're right. "Regression" was inaccurate; the missing KF_RET_NULL
metadata has been there since the kfunc was introduced by 6203ef73fa5c.

If the preferred direction is to remove scx_bpf_cpu_rq(), I'll drop this 
series.