sched_ext: Fix cgroup double-put on sub-sched abort path

The abort path in scx_sub_enable_workfn() fell through to out_put_cgrp,
double-putting the cgroup ref already owned by sch->cgrp. It also skipped
kthread_flush_work() needed to flush the disable path.

Relocate the abort block above err_unlock_and_disable so it falls through to
err_disable.

Fixes: 337ec00b1d9c ("sched_ext: Implement cgroup sub-sched enabling and disabling")
Signed-off-by: Tejun Heo <tj@kernel.org>
Reviewed-by: Andrea Righi <arighi@nvidia.com>

diff --git a/kernel/sched/ext.c b/kernel/sched/ext.c
index 9202c6d7a77130e5dc3e22f4d73f73eca56b18c8..2f70effcc4a656cb2d84bd15697a20f5ffc93356 100644 (file)
--- a/kernel/sched/ext.c
+++ b/kernel/sched/ext.c
@@ -7050,6 +7050,13 @@ static void scx_sub_enable_workfn(struct kthread_work *work)
        ret = 0;
        goto out_unlock;
 
+out_put_cgrp:
+       cgroup_put(cgrp);
+out_unlock:
+       mutex_unlock(&scx_enable_mutex);
+       cmd->ret = ret;
+       return;
+
 abort:
        put_task_struct(p);
        scx_task_iter_stop(&sti);
@@ -7063,15 +7070,6 @@ abort:
                }
        }
        scx_task_iter_stop(&sti);
-       scx_cgroup_unlock();
-       percpu_up_write(&scx_fork_rwsem);
-out_put_cgrp:
-       cgroup_put(cgrp);
-out_unlock:
-       mutex_unlock(&scx_enable_mutex);
-       cmd->ret = ret;
-       return;
-
 err_unlock_and_disable:
        /* we'll soon enter disable path, keep bypass on */
        scx_cgroup_unlock();