mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: Tejun Heo <tj@kernel.org>
To: David Carlier <devnexen@gmail.com>
Cc: David Vernet <void@manifault.com>, linux-kernel@vger.kernel.org
Subject: Re: [PATCH 1/2] sched_ext: Use rcu_dereference() for scx_root in dump paths
Date: Fri, 27 Feb 2026 08:31:10 -1000	[thread overview]
Message-ID: <aaHi7novL31JI3An@slm.duckdns.org> (raw)
In-Reply-To: <20260226052640.7191-1-devnexen@gmail.com>

Hello,

On Thu, Feb 26, 2026 at 05:26:39AM +0000, David Carlier wrote:
> scx_dump_task() and scx_dump_state() read scx_root directly without
> rcu_dereference() or NULL check. If the BPF scheduler is torn down
> concurrently, scx_root can become NULL between the read and the
> dereference in SCX_HAS_OP(), causing a NULL pointer dereference.

scx_dump_state() is called from scx_error_irq_workfn() and
sysrq_handle_sched_ext_dump(). SCX can't turn off before dump is complete in
the former case. In the latter, scx_enabled() gates the call and it's in the
irq context. When scx_enabled() turns off, there's synchronize_rcu() call
afterwards before anything happens to scx_root. ie. It cannot go away in
flight. This is the same synchronization that protect other in-flight sched
ops.

Thanks.

-- 
tejun

  parent reply	other threads:[~2026-02-27 18:31 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-02-26  5:26 David Carlier
2026-02-26  5:26 ` [PATCH 2/2] sched_ext: Fix TOCTOU on p->scx.dsq in scx_dump_task() David Carlier
2026-02-27 18:33   ` Tejun Heo
2026-02-27 18:41     ` David CARLIER
2026-02-27 18:31 ` Tejun Heo [this message]
2026-02-27 19:04   ` [PATCH 1/2] sched_ext: Use rcu_dereference() for scx_root in dump paths David CARLIER

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=aaHi7novL31JI3An@slm.duckdns.org \
    --to=tj@kernel.org \
    --cc=devnexen@gmail.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=void@manifault.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®