Messages in this thread Patch in this message |  | | Date | Sun, 7 Dec 2025 14:54:04 +0100 | | From | Andrea Righi <> | | Subject | Re: [RFC][PATCH] sched/ext: Avoid null ptr traversal when ->put_prev_task() is called with NULL next |
| |
On Sat, Dec 06, 2025 at 02:22:03AM +0000, John Stultz wrote: > Early when trying to get sched_ext and proxy-exe working together, > I kept tripping over NULL ptr in put_prev_task_scx() on the line: > if (sched_class_above(&ext_sched_class, next->sched_class)) { > > Which was due to put_prev_task() passes a NULL next, calling: > prev->sched_class->put_prev_task(rq, prev, NULL); > > put_prev_task_scx() already guards for a NULL next in the > switch_class case, but doesn't seem to have a guard for > sched_class_above() check. > > I can't say I understand why this doesn't trip usually without > proxy-exec. And in newer kernels there are way fewer > put_prev_task(), and I can't easily reproduce the issue now > even with proxy-exec. > > But we still have one put_prev_task() call left in core.c that > seems like it could trip this, so I wanted to send this out for > consideration. > > Signed-off-by: John Stultz <jstultz@google.com>
This looks like a valid fix to me. If the task changes any sched property while it's running, we go through sched_change_begin() which calls put_prev_task() that always passes NULL as the next parameter:
static inline void put_prev_task(struct rq *rq, struct task_struct *prev) { WARN_ON_ONCE(rq->donor != prev); prev->sched_class->put_prev_task(rq, prev, NULL); }
This should be the code path(s) to trigger the bug:
sys_setpriority() / sched_setaffinity() / sched_setscheduler() - set_user_nice() / __sched_setaffinity() / __sched_setscheduler() - scoped_guard(sched_change, p, DEQUEUE_SAVE) - sched_change_begin(p, DEQUEUE_SAVE) - if (ctx->running) put_prev_task(rq, p) - prev->sched_class->put_prev_task(rq, prev, NULL) - put_prev_task_scx(rq, prev, NULL) - if (sched_class_above(&ext_sched_class, next->sched_class)) ^^^^ NULL dereference
Reviewed-by: Andrea Righi <arighi@nvidia.com>
Thanks, -Andrea
> --- > Cc: Joel Fernandes <joelagnelf@nvidia.com> > Cc: Qais Yousef <qyousef@layalina.io> > Cc: Ingo Molnar <mingo@redhat.com> > Cc: Peter Zijlstra <peterz@infradead.org> > Cc: Juri Lelli <juri.lelli@redhat.com> > Cc: Vincent Guittot <vincent.guittot@linaro.org> > Cc: Dietmar Eggemann <dietmar.eggemann@arm.com> > Cc: Valentin Schneider <vschneid@redhat.com> > Cc: Steven Rostedt <rostedt@goodmis.org> > Cc: Ben Segall <bsegall@google.com> > Cc: Zimuzo Ezeozue <zezeozue@google.com> > Cc: Mel Gorman <mgorman@suse.de> > Cc: Will Deacon <will@kernel.org> > Cc: Waiman Long <longman@redhat.com> > Cc: Boqun Feng <boqun.feng@gmail.com> > Cc: "Paul E. McKenney" <paulmck@kernel.org> > Cc: Metin Kaya <Metin.Kaya@arm.com> > Cc: Xuewen Yan <xuewen.yan94@gmail.com> > Cc: K Prateek Nayak <kprateek.nayak@amd.com> > Cc: Thomas Gleixner <tglx@linutronix.de> > Cc: Daniel Lezcano <daniel.lezcano@linaro.org> > Cc: Suleiman Souhlal <suleiman@google.com> > Cc: kuyo chang <kuyo.chang@mediatek.com> > Cc: hupu <hupu.gm@gmail.com> > Cc: Tejun Heo <tj@kernel.org> > Cc: David Vernet <void@manifault.com> > Cc: Andrea Righi <arighi@nvidia.com> > Cc: Changwoo Min <changwoo@igalia.com> > Cc: sched-ext@lists.linux.dev > Cc: kernel-team@android.com > --- > kernel/sched/ext.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/kernel/sched/ext.c b/kernel/sched/ext.c > index 446091cba4429..598552f58f5ec 100644 > --- a/kernel/sched/ext.c > +++ b/kernel/sched/ext.c > @@ -2402,7 +2402,7 @@ static void put_prev_task_scx(struct rq *rq, struct task_struct *p, > * ops.enqueue() that @p is the only one available for this cpu, > * which should trigger an explicit follow-up scheduling event. > */ > - if (sched_class_above(&ext_sched_class, next->sched_class)) { > + if (next && sched_class_above(&ext_sched_class, next->sched_class)) { > WARN_ON_ONCE(!(sch->ops.flags & SCX_OPS_ENQ_LAST)); > do_enqueue_task(rq, p, SCX_ENQ_LAST, -1); > } else { > -- > 2.52.0.223.gf5cc29aaa4-goog >
|  |