[PATCH bpf-next] sched_ext: Reset task fields on exit of an SCX_TASK_READY task

[PATCH bpf-next] sched_ext: Reset task fields on exit of an SCX_TASK_READY task

[Rahad Bhuiya]

Commit a298fd5f4ee8 ("sched_ext: Fix use-after-free of a NONE rescuee
leaving its sched while running") moved the reset of SCX-managed fields
out of scx_disable_task() into scx_reset_task_fields() so that it can be
invoked on every path where a task leaves its scheduler's control,
including tasks in SCX_TASK_NONE.

However, in __scx_disable_and_exit_task(), an exiting task in state
SCX_TASK_READY (e.g., a forked task that was initialized via
ops.init_task() but never enabled under an ext_sched_class before exiting,
or a disabled task) currently breaks out of the state switch without
calling scx_reset_task_fields().

Consequently, its managed fields (vtime, slice, reenqueue flags, and
watchdog runnable_at reset) are not reset, violating the invariant that a
task leaving its scheduler's control starts clean.

Call scx_reset_task_fields() in the SCX_TASK_READY case of
__scx_disable_and_exit_task() to ensure consistent cleanup across all exit
paths.

Fixes: a298fd5f4ee8 ("sched_ext: Fix use-after-free of a NONE rescuee leaving its sched while running")
Signed-off-by: Rahad Bhuiya <rahadbhuiya2021@gmail.com>
---
 kernel/sched/ext/ext.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/kernel/sched/ext/ext.c b/kernel/sched/ext/ext.c
index f74ffb3b1aca..b57a7989f304 100644
--- a/kernel/sched/ext/ext.c
+++ b/kernel/sched/ext/ext.c
@@ -4728,6 +4728,7 @@ void __scx_disable_and_exit_task(struct scx_sched *sch, struct task_struct *p)
 		args.cancelled = true;
 		break;
 	case SCX_TASK_READY:
+		scx_reset_task_fields(task_rq(p), p);
 		break;
 	case SCX_TASK_ENABLED:
 		scx_disable_task(sch, p);
-- 
2.55.0.windows.3

Re: [PATCH bpf-next] sched_ext: Reset task fields on exit of an SCX_TASK_READY task

[Tejun Heo]

Hello, Rahad.

On Fri, Nov 06, 2026 at 08:28:18PM +0600, Rahad Bhuiya wrote:
> However, in __scx_disable_and_exit_task(), an exiting task in state
> SCX_TASK_READY (e.g., a forked task that was initialized via
> ops.init_task() but never enabled under an ext_sched_class before exiting,
> or a disabled task) currently breaks out of the state switch without
> calling scx_reset_task_fields().

Neither example has anything to reset. A forked task which exits while
READY goes through sched_ext_dead() and is freed. A task disabled from
ENABLED is already reset: both callers of scx_disable_task(), the
ENABLED case here and switched_from_scx(), call scx_reset_task_fields()
right after it.

A READY task is on a sched but outside the ext class. RT and DL tasks
are always in that state, and so are non-SCHED_EXT tasks under a partial
switch. The sched's BPF code can still write such a task's dsq_vtime and
slice, and because the READY exit doesn't reset them, they carry over
when the task moves to another sched.

For example, an RT task in a cgroup owned by sub-sched A gets its
dsq_vtime set by A's ops.cgroup_move(), as scx_flatcg does. If the task
is then moved to a cgroup owned by sub-sched B and later switches to
SCHED_NORMAL, B's ops.enable() sees the dsq_vtime from A's clock.

Can you rewrite the description around that case?

> Fixes: a298fd5f4ee8 ("sched_ext: Fix use-after-free of a NONE rescuee leaving its sched while running")

a298fd5f4ee8 didn't change the READY case. It was a bare break before
and after. The gap goes back to 5771e79e461e ("sched_ext: Reset
dsq_vtime and slice when a task leaves SCX"), which put the reset only
on the ENABLED path, so that'd be the one to point at if the patch keeps
a Fixes tag.

sched_ext patches go through the sched_ext tree, not bpf-next. Can you
repost with the above updated?

Thanks.

--
tejun

[PATCH v2] sched_ext: Reset task fields on exit of an SCX_TASK_READY task

[Rahad Bhuiya]

Tasks in SCX_TASK_READY are attached to a scheduler but outside the ext
class, such as RT/DL tasks, or non-SCHED_EXT tasks under a partial switch.
The scheduler's BPF code can still update their dsq_vtime and slice (for
instance, via ops.cgroup_move() as done by scx_flatcg).

Because __scx_disable_and_exit_task() currently breaks out of the state
switch for SCX_TASK_READY without calling scx_reset_task_fields(), these
fields are not cleared when the task leaves the scheduler. If the task is
subsequently moved to another cgroup/sub-scheduler and later switches to
SCHED_NORMAL, the new scheduler's ops.enable() sees stale dsq_vtime from
the previous scheduler's clock.

Call scx_reset_task_fields() in the SCX_TASK_READY case of
__scx_disable_and_exit_task() to ensure SCX-managed fields are properly
reset when leaving the scheduler.

Fixes: 5771e79e461e ("sched_ext: Reset dsq_vtime and slice when a task leaves SCX")
Signed-off-by: Rahad Bhuiya <rahadbhuiya2021@gmail.com>
---
v2:
- Rewrote the commit description to describe the cgroup sub-sched / RT task
  migration case (per Tejun Heo).
- Updated Fixes: tag to 5771e79e461e ("sched_ext: Reset dsq_vtime and slice
  when a task leaves SCX").
- Targeted sched_ext tree instead of bpf-next.

 kernel/sched/ext/ext.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/kernel/sched/ext/ext.c b/kernel/sched/ext/ext.c
index f74ffb3b1aca..b57a7989f304 100644
--- a/kernel/sched/ext/ext.c
+++ b/kernel/sched/ext/ext.c
@@ -4728,6 +4728,7 @@ void __scx_disable_and_exit_task(struct scx_sched *sch, struct task_struct *p)
 		args.cancelled = true;
 		break;
 	case SCX_TASK_READY:
+		scx_reset_task_fields(task_rq(p), p);
 		break;
 	case SCX_TASK_ENABLED:
 		scx_disable_task(sch, p);
-- 
2.55.0.windows.3

Re: [PATCH v2] sched_ext: Reset task fields on exit of an SCX_TASK_READY task

[Tejun Heo]

Applied to sched_ext/for-7.4-fixes.

Thanks.

--
tejun