From: Tejun Heo <tj@kernel.org>
Date: Sat, 25 Apr 2026 00:31:36 +0000 (-1000)
Subject: sched_ext: Release cpus_read_lock on scx_link_sched() failure in root enable
X-Git-Tag: v7.1-rc2~27^2~2
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=deb7b2f93d0129b79425f830a1e5e7e1bb2c4973;p=thirdparty%2Fkernel%2Flinux.git

sched_ext: Release cpus_read_lock on scx_link_sched() failure in root enable

scx_root_enable_workfn() takes cpus_read_lock() before
scx_link_sched(sch), but the `if (ret) goto err_disable` on failure
skips the matching cpus_read_unlock() - all other err_disable gotos
along this path drop the lock first.

scx_link_sched() only returns non-zero on the sub-sched path
(parent != NULL), so the leak path is unreachable via the root
caller today. Still, the unwind is out of line with the surrounding
paths.

Drop cpus_read_lock() before goto err_disable.

v2: Correct Fixes: tag (Andrea Righi).

Fixes: 25037af712eb ("sched_ext: Add rhashtable lookup for sub-schedulers")
Reported-by: Chris Mason <clm@meta.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
---

diff --git a/kernel/sched/ext.c b/kernel/sched/ext.c
index f333fd0cb83f..9eda20e5fdb8 100644
--- a/kernel/sched/ext.c
+++ b/kernel/sched/ext.c
@@ -6736,8 +6736,10 @@ static void scx_root_enable_workfn(struct kthread_work *work)
 	rcu_assign_pointer(scx_root, sch);
 
 	ret = scx_link_sched(sch);
-	if (ret)
+	if (ret) {
+		cpus_read_unlock();
 		goto err_disable;
+	}
 
 	scx_idle_enable(ops);