sched_ext: Clear ops->priv on scx_alloc_and_add_sched() error paths

scx_alloc_and_add_sched() can fail after @sch has been assigned to
ops->priv. In those cases @sch is torn down (either via kfree() through
the err_free_* chain or via kobject_put() -> scx_kobj_release() -> RCU
work), but @ops->priv is left pointing at the about-to-be-freed pointer.

With the recent -EBUSY gate in scx_root_enable_workfn() and
scx_sub_enable_workfn() that rejects an attach when @ops->priv is still
non-NULL, see commit bbf30b383cf6 ("sched_ext: Fix ops->priv clobber on
concurrent attach/detach"), a dangling @ops->priv permanently locks the
kdata out: every future attach attempt sees a stale binding and returns
-EBUSY even though no scheduler is actually attached.

Clear @ops->priv on the post-assign failure paths so that the kdata
returns to its pre-attach state when the function returns ERR_PTR().

Fixes: bbf30b383cf6 ("sched_ext: Fix ops->priv clobber on concurrent attach/detach")
Suggested-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Andrea Righi <arighi@nvidia.com>
Signed-off-by: Tejun Heo <tj@kernel.org>

diff --git a/kernel/sched/ext.c b/kernel/sched/ext.c
index 8e06694094d78bbd1a6dcae280ddb1892ddda0eb..1efd5d82b08bba16d2993fc83f10a5e7a9703022 100644 (file)
--- a/kernel/sched/ext.c
+++ b/kernel/sched/ext.c
@@ -6670,6 +6670,7 @@ static struct scx_sched *scx_alloc_and_add_sched(struct sched_ext_ops *ops,
                ret = kobject_init_and_add(&sch->kobj, &scx_ktype, NULL, "root");
 
        if (ret < 0) {
+               RCU_INIT_POINTER(ops->priv, NULL);
                kobject_put(&sch->kobj);
                return ERR_PTR(ret);
        }
@@ -6677,6 +6678,7 @@ static struct scx_sched *scx_alloc_and_add_sched(struct sched_ext_ops *ops,
        if (ops->sub_attach) {
                sch->sub_kset = kset_create_and_add("sub", NULL, &sch->kobj);
                if (!sch->sub_kset) {
+                       RCU_INIT_POINTER(ops->priv, NULL);
                        kobject_put(&sch->kobj);
                        return ERR_PTR(-ENOMEM);
                }
@@ -6684,6 +6686,7 @@ static struct scx_sched *scx_alloc_and_add_sched(struct sched_ext_ops *ops,
 #else  /* CONFIG_EXT_SUB_SCHED */
        ret = kobject_init_and_add(&sch->kobj, &scx_ktype, NULL, "root");
        if (ret < 0) {
+               RCU_INIT_POINTER(ops->priv, NULL);
                kobject_put(&sch->kobj);
                return ERR_PTR(ret);
        }
@@ -6692,6 +6695,7 @@ static struct scx_sched *scx_alloc_and_add_sched(struct sched_ext_ops *ops,
 
 #ifdef CONFIG_EXT_SUB_SCHED
 err_free_lb_resched:
+       RCU_INIT_POINTER(ops->priv, NULL);
        free_cpumask_var(sch->bypass_lb_resched_cpumask);
 #endif
 err_free_lb_cpumask: