]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
sched_ext: Remove redundant css_put() in scx_cgroup_init()
authorCheng-Yang Chou <yphbchou0911@gmail.com>
Tue, 3 Mar 2026 14:35:30 +0000 (22:35 +0800)
committerTejun Heo <tj@kernel.org>
Tue, 3 Mar 2026 16:22:37 +0000 (06:22 -1000)
commit1336b579f6079fb8520be03624fcd9ba443c930b
tree14b3c0adad6e84c8ad72c17f946ef932eab50dc8
parent75ad51825933575906394d0d5db04586b02db00a
sched_ext: Remove redundant css_put() in scx_cgroup_init()

The iterator css_for_each_descendant_pre() walks the cgroup hierarchy
under cgroup_lock(). It does not increment the reference counts on
yielded css structs.

According to the cgroup documentation, css_put() should only be used
to release a reference obtained via css_get() or css_tryget_online().
Since the iterator does not use either of these to acquire a reference,
calling css_put() in the error path of scx_cgroup_init() causes a
refcount underflow.

Remove the unbalanced css_put() to prevent a potential Use-After-Free
(UAF) vulnerability.

Fixes: 819513666966 ("sched_ext: Add cgroup support")
Cc: stable@vger.kernel.org # v6.12+
Signed-off-by: Cheng-Yang Chou <yphbchou0911@gmail.com>
Reviewed-by: Andrea Righi <arighi@nvidia.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
kernel/sched/ext.c