Re: [PATCH v3 sched_ext/for-7.3 09/36] sched_ext: Make the kick machinery per-sched

[Tejun Heo]

On Tue, 07 Jul 2026 00:33:33 +0000, sashiko-bot@xxxxxxxxxx wrote:
> - [High] Early return in `kick_cpus_irq_workfn()` skips removing `pcpu->to_kick_node` from `sched_pcpus_to_kick` if `ksyncs_pcpu` is NULL, leading to a Use-After-Free when the `pcpu` structure is later freed.

The UAF isn't reachable: disable turns on bypass and does a
synchronize_rcu() before free_kick_syncs(), which fires any pending kick
irq_work first, so the workfn unlinks its to_kick_node while ksyncs is
still published. I've added an explicit irq_work_sync() in the free path
anyway so the invariant is local rather than resting on the disable-path
ordering.

Thanks.

-- 
tejun