[PATCH] sched_ext: Fix NULL dereference in find_parent_sched()

From: Cui Jian

Date: Fri Aug 07 2026 - 05:39:30 EST


find_parent_sched() dereferences cgrp->scx_sched without checking
for NULL. cgroup_get_from_id() can return cgroups from any
hierarchy, including cgroup v1 where scx_sched is never set.

A BPF program that passes a v1 cgroup ID as sub_cgroup_id would
hit parent->cgrp on a NULL pointer and crash the kernel.

Add a NULL check and return -ENODEV.

Signed-off-by: Cui Jian <cjian720@xxxxxxx>
---
kernel/sched/ext/sub.c | 4 ++++
1 file changed, 4 insertions(+)

diff --git a/kernel/sched/ext/sub.c b/kernel/sched/ext/sub.c
index d7842a609d96..6395281bae71 100644
--- a/kernel/sched/ext/sub.c
+++ b/kernel/sched/ext/sub.c
@@ -1209,6 +1209,10 @@ static struct scx_sched *find_parent_sched(struct cgroup *cgrp)

lockdep_assert_held(&scx_sched_lock);

+ /* no SCX sched */
+ if (!parent)
+ return ERR_PTR(-ENODEV);
+
/* can't attach twice to the same cgroup */
if (parent->cgrp == cgrp)
return ERR_PTR(-EBUSY);
--
2.34.1