]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
sched_ext: Use WRITE_ONCE() for the write side of scx_enable helper pointer
authorzhidao su <suzhidao@xiaomi.com>
Mon, 9 Mar 2026 02:46:12 +0000 (10:46 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 19 Mar 2026 15:15:33 +0000 (16:15 +0100)
commit735ee0208f22da5f833072fd30da240894e1c162
treee8b38e46e0a347be5adf59d4217d7e2728ca692a
parentac8befc7fe3c325ebdf10f6dfc458260f8b98114
sched_ext: Use WRITE_ONCE() for the write side of scx_enable helper pointer

commit 2fcfe5951eb2e8440fc5e1dd6ea977336ff83a1d upstream.

scx_enable() uses double-checked locking to lazily initialize a static
kthread_worker pointer. The fast path reads helper locklessly:

    if (!READ_ONCE(helper)) {          // lockless read -- no helper_mutex

The write side initializes helper under helper_mutex, but previously
used a plain assignment:

        helper = kthread_run_worker(0, "scx_enable_helper");
                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
                 plain write -- KCSAN data race with READ_ONCE() above

Since READ_ONCE() on the fast path and the plain write on the
initialization path access the same variable without a common lock,
they constitute a data race. KCSAN requires that all sides of a
lock-free access use READ_ONCE()/WRITE_ONCE() consistently.

Use a temporary variable to stage the result of kthread_run_worker(),
and only WRITE_ONCE() into helper after confirming the pointer is
valid. This avoids a window where a concurrent caller on the fast path
could observe an ERR pointer via READ_ONCE(helper) before the error
check completes.

Fixes: b06ccbabe250 ("sched_ext: Fix starvation of scx_enable() under fair-class saturation")
Signed-off-by: zhidao su <suzhidao@xiaomi.com>
Acked-by: Andrea Righi <arighi@nvidia.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
kernel/sched/ext.c