]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
sched_ext: Clear ops->priv on scx_alloc_and_add_sched() error paths
authorAndrea Righi <arighi@nvidia.com>
Mon, 11 May 2026 08:31:30 +0000 (10:31 +0200)
committerTejun Heo <tj@kernel.org>
Mon, 11 May 2026 08:50:31 +0000 (22:50 -1000)
commit86ecb1c1a1f5c1bf4a45b91f54f8220c3121bd3b
tree04ee165a80bd153f7dc243330ef64fbd322f77d2
parentbbf30b383cf6e87f2fe57c292fbd640b1d88b4c3
sched_ext: Clear ops->priv on scx_alloc_and_add_sched() error paths

scx_alloc_and_add_sched() can fail after @sch has been assigned to
ops->priv. In those cases @sch is torn down (either via kfree() through
the err_free_* chain or via kobject_put() -> scx_kobj_release() -> RCU
work), but @ops->priv is left pointing at the about-to-be-freed pointer.

With the recent -EBUSY gate in scx_root_enable_workfn() and
scx_sub_enable_workfn() that rejects an attach when @ops->priv is still
non-NULL, see commit bbf30b383cf6 ("sched_ext: Fix ops->priv clobber on
concurrent attach/detach"), a dangling @ops->priv permanently locks the
kdata out: every future attach attempt sees a stale binding and returns
-EBUSY even though no scheduler is actually attached.

Clear @ops->priv on the post-assign failure paths so that the kdata
returns to its pre-attach state when the function returns ERR_PTR().

Fixes: bbf30b383cf6 ("sched_ext: Fix ops->priv clobber on concurrent attach/detach")
Suggested-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Andrea Righi <arighi@nvidia.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
kernel/sched/ext.c