[PATCH] sched_ext: Fix NULL dereference in find_parent_sched()
From: Cui Jian
Date: Fri Aug 07 2026 - 05:39:30 EST
find_parent_sched() dereferences cgrp->scx_sched without checking
for NULL. cgroup_get_from_id() can return cgroups from any
hierarchy, including cgroup v1 where scx_sched is never set.
A BPF program that passes a v1 cgroup ID as sub_cgroup_id would
hit parent->cgrp on a NULL pointer and crash the kernel.
Add a NULL check and return -ENODEV.
Signed-off-by: Cui Jian <cjian720@xxxxxxx>
---
kernel/sched/ext/sub.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/kernel/sched/ext/sub.c b/kernel/sched/ext/sub.c
index d7842a609d96..6395281bae71 100644
--- a/kernel/sched/ext/sub.c
+++ b/kernel/sched/ext/sub.c
@@ -1209,6 +1209,10 @@ static struct scx_sched *find_parent_sched(struct cgroup *cgrp)
lockdep_assert_held(&scx_sched_lock);
+ /* no SCX sched */
+ if (!parent)
+ return ERR_PTR(-ENODEV);
+
/* can't attach twice to the same cgroup */
if (parent->cgrp == cgrp)
return ERR_PTR(-EBUSY);
--
2.34.1