tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

sched_ext: Reject NULL-sch callers in scx_bpf_task_set_slice/dsq_vtime

scx_prog_sched(aux) returns NULL for TRACING / SYSCALL BPF progs that
have no struct_ops association when the root scheduler has sub_attach
set. scx_bpf_task_set_slice() and scx_bpf_task_set_dsq_vtime() pass
that NULL into scx_task_on_sched(sch, p), which under
CONFIG_EXT_SUB_SCHED is rcu_access_pointer(p->scx.sched) == sch. For
any non-scx task p->scx.sched is NULL, so NULL == NULL returns true
and the authority gate is bypassed - a privileged but
non-struct_ops-associated prog can poke p->scx.slice /
p->scx.dsq_vtime on arbitrary tasks.

Reject !sch up front so the gate only admits callers with a resolved
scheduler.

Fixes: 245d09c594ea ("sched_ext: Enforce scheduler ownership when updating slice and dsq_vtime")
Reported-by: Chris Mason <clm@meta.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Reviewed-by: Andrea Righi <arighi@nvidia.com>

Tejun Heo 05b4a9a9 ea7c716a

+2 -2
+2 -2
kernel/sched/ext.c
··· 8640 8640 8641 8641 guard(rcu)(); 8642 8642 sch = scx_prog_sched(aux); 8643 - if (unlikely(!scx_task_on_sched(sch, p))) 8643 + if (unlikely(!sch || !scx_task_on_sched(sch, p))) 8644 8644 return false; 8645 8645 8646 8646 p->scx.slice = slice; ··· 8663 8663 8664 8664 guard(rcu)(); 8665 8665 sch = scx_prog_sched(aux); 8666 - if (unlikely(!scx_task_on_sched(sch, p))) 8666 + if (unlikely(!sch || !scx_task_on_sched(sch, p))) 8667 8667 return false; 8668 8668 8669 8669 p->scx.dsq_vtime = vtime;