Re: [PATCHSET sched_ext/for-7.2-fixes] sched_ext: Assorted sub-scheduler and cgroup fixes

[Andrea Righi <arighi@nvidia.com>]

Hi Tejun,

On Thu, Jul 16, 2026 at 11:30:54AM -1000, Tejun Heo wrote:
> This patchset contains three sub-scheduler fixes and a cgroup lock
> ordering deadlock fix.
> 
>  0001-sched_ext-Reject-setting-disallow-from-init_task-out.patch
>  0002-sched_ext-Take-cgroup_lock-first-in-scx_cgroup_lock.patch
>  0003-sched_ext-Skip-sub-disable-teardown-for-never-linked.patch
>  0004-sched_ext-Don-t-enable-non-ext-tasks-in-the-sub-sche.patch
> 
> - 0001 makes ops.init_task() setting p->scx.disallow outside the enable
>   path fail the scheduler. The sub-scheduler disable path could reach the
>   load-path-only policy revert and silently rewrite a live task's policy.
> 
> - 0002 fixes a three-way deadlock among scx_cgroup_lock(), cgroup teardown
>   draining the cpu controller's files, and a concurrent cpu.weight write.
>   Present in released kernels since v6.18 and marked for stable.
> 
> - 0003 fixes a use-after-free when a sub-scheduler whose enable failed
>   before linking is torn down concurrently with root disable.
> 
> - 0004 gates task enabling on the ext class in the sub-scheduler task
>   loops. A non-ext task under an SCX_OPS_SWITCH_PARTIAL root could be
>   marked ENABLED while staying on its own class, corrupting the task state
>   machine.

I randomly triggered the following with this applied, but it looks unrelated to
these changes:

  [  140.251732] BUG: unable to handle page fault for address: 0000000000020037
  [  140.251914] #PF: supervisor write access in kernel mode
  [  140.252020] #PF: error_code(0x0002) - not-present page
  [  140.252163] PGD 0 P4D 0
  [  140.252237] Oops: Oops: 0002 [#1] SMP NOPTI
  [  140.252339] CPU: 5 UID: 0 PID: 103 Comm: kworker/u65:1 Not tainted 7.1.0-virtme #1 PREEMPT(full)
  [  140.252575] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
  [  140.252704] Workqueue: events_unbound scx_watchdog_workfn
  [  140.252766] Sched_ext: qmap (enabled+all), task: runnable_at=-1ms
  [  140.252768] RIP: 0010:scx_claim_exit+0xfd/0x190
  [  140.252897] Code: 02 00 74 24 65 8b 05 4a ac ce 02 85 c0 75 19 65 8b 05 27 68 ce 02 a9 ff ff ff 7f
  75 0b 65 8b 05 a1 a8 ce 02 85 c0 75 46 31 c0 <f0> 45 0f b1 a7 28 04 00 00 75 14 41 c6 87 b4 03 00 00 01
  49 8d bf
  [  140.253102] RSP: 0018:ffffc900003f7d10 EFLAGS: 00010046
  [  140.253160] RAX: 0000000000000000 RBX: ffff888125ed5000 RCX: ffffea0004768bb2
  [  140.253232] RDX: 000000008881093f RSI: ffffffff83685140 RDI: ffff888100c45440
  [  140.253316] RBP: 0000000000000001 R08: ffffffff8411c438 R09: ffff888100c45440
  [  140.253406] R10: 00000000000003e5 R11: ffff888100c44780 R12: 0000000000000044
  [  140.253501] R13: 0000000000000000 R14: 0000000000000016 R15: 000000000001fc0f
  [  140.253595] FS:  0000000000000000(0000) GS:ffff8882b379a000(0000) knlGS:0000000000000000
  [  140.253681] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  [  140.253791] CR2: 0000000000020037 CR3: 000000000364c000 CR4: 0000000000750ef0
  [  140.253865] PKRU: 55555554
  [  140.253903] Call Trace:
  [  140.253966]  <TASK>
  [  140.253996]  scx_vexit+0x3a/0x170
  [  140.254041]  __scx_exit+0x51/0x70
  [  140.254087]  scx_watchdog_workfn+0x25f/0x360
  [  140.254156]  ? process_scheduled_works+0x219/0x510
  [  140.254208]  process_scheduled_works+0x265/0x510
  [  140.254272]  worker_thread+0x226/0x360
  [  140.254311]  ? __pfx_worker_thread+0x10/0x10
  [  140.254386]  kthread+0x10c/0x140
  [  140.254425]  ? __pfx_kthread+0x10/0x10
  [  140.254465]  ret_from_fork+0x189/0x330
  [  140.254521]  ? __pfx_kthread+0x10/0x10
  [  140.254562]  ret_from_fork_asm+0x1a/0x30
  [  140.254608]  </TASK>
  [  140.254633] Modules linked in:
  [  140.254689] CR2: 0000000000020037
  [  140.254733] ---[ end trace 0000000000000000 ]---

This might be a pre-existent bug, I'll investigate a bit.

Thanks,
-Andrea

> 
> This is against sched_ext/for-7.2-fixes (0e2f4ab68a89) and also available
> in the following git branch:
> 
>  https://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext.git scx-sub-cgroup-fixes
> 
> diffstat follows.
> 
>  include/linux/sched/ext.h | 10 +++++-----
>  kernel/sched/ext/ext.c    | 47 ++++++++++++++++++++++++++++++++++++++---------
>  2 files changed, 43 insertions(+), 14 deletions(-)
> 
> --
> tejun