[PATCHSET v2] sched/psi: Fix psimon fork deadlock and rtpoll_timer UAF

[Tejun Heo]

Hello,

v2: - Retagged sched/psi (was cgroup) (patch 1).
    - Added a fix for a pre-existing rtpoll_timer use-after-free that the
      Sashiko AI review flagged on the previous posting (patch 2).

v1: https://lore.kernel.org/r/20260710134945-psimon-fix-tj@xxxxxxxxxx

a5b98009f16d ("sched/psi: fix race between file release and pressure
write") made pressure_write() fork the psimon kthread while holding
cgroup_mutex, which deadlocks against the sched_ext enable path blocking
forks before grabbing cgroup_mutex. Patch 1 moves the fork outside
cgroup_mutex. Patch 2 fixes the use-after-free from a schedule attempt
re-arming group->rtpoll_timer behind psi_trigger_destroy() by shutting
down the timer when the group is freed.

Matt, patch 1 is unchanged from the previous posting except for the
subject prefix, so test results against that posting still apply.

Peter, once these are reviewed and tested, how do you want them routed?
I can take them through the cgroup tree if that works for you.

Patches:

  [PATCH 1/2] sched/psi: Create the psimon kthread outside of cgroup_mutex
  [PATCH 2/2] sched/psi: Shut down rtpoll_timer in psi_cgroup_free()

Based on cgroup/for-7.2-fixes (97fef6025844).

 include/linux/psi.h    |  4 ++-
 kernel/cgroup/cgroup.c | 23 +++++++++++++++-
 kernel/sched/psi.c     | 75 +++++++++++++++++++++++++++++++++++++++-----------
 3 files changed, 84 insertions(+), 18 deletions(-)

Thanks.

--
tejun