Re: [PATCH] sched_ext: Fix NULL dereference in find_parent_sched()

[Zhan Xusheng]

On Fri, 7 Aug 2026 17:38:37 +0800, Cui Jian wrote:
> cgroup_get_from_id() can return cgroups from any hierarchy, including
> cgroup v1 where scx_sched is never set.

It can't.  The id is looked up in the v2 kernfs root only:
	kn = kernfs_find_and_get_node_by_id(cgrp_dfl_root.kf_root, id);

so a v1 id gets -ENOENT there, and even if it were found,
cgroup_get_from_id() rejects it through cgroup_is_descendant(), which
starts with cgrp->root != ancestor->root.  A v1 cgroup never reaches
find_parent_sched().  That also fits ->scx_sched being v2-only anyway:
scx_cgroup_lifetime_notify() bails out on !cgroup_on_dfl(cgrp).

Is there another window?  I could not find one in ext.c: sub-enable
checks scx_enabled() under scx_enable_mutex, root enable sets
->scx_sched on every live v2 descendant, cgroups created later inherit
it in the ONLINE notifier, and the sweep and the notifier both run under
cgroup_mutex.

I am reading ext.c since sub.c is not upstream yet, so the split may have
introduced something I cannot see.  The cgroup_get_from_id() part is
independent of that.

As hardening the check is harmless, but the changelog reads as a
reachable crash, and that wording travels into backport and CVE
decisions.

Thanks,
Zhan Xusheng