]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path
authorTejun Heo <tj@kernel.org>
Mon, 11 May 2026 22:05:48 +0000 (12:05 -1000)
committerTejun Heo <tj@kernel.org>
Mon, 11 May 2026 22:05:48 +0000 (12:05 -1000)
commit9a415cc53711f2238e0f0ca8a6bcc796c003b127
tree01457067f3d0db705e447ca715917d56033ac764
parent86ecb1c1a1f5c1bf4a45b91f54f8220c3121bd3b
sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path

In scx_root_enable_workfn(), put_task_struct(p) is called before scx_error()
dereferences p->comm and p->pid. If the iterator's reference is the last
drop, the task is freed synchronously and the deref becomes a UAF.

Move put_task_struct() past scx_error().

Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/all/20260511214031.AF5E9C2BCB0@smtp.kernel.org/
Fixes: f0e1a0643a59 ("sched_ext: Implement BPF extensible scheduler class")
Cc: stable@vger.kernel.org # v6.12+
Signed-off-by: Tejun Heo <tj@kernel.org>
kernel/sched/ext.c