Re: [PATCH] sched_ext: don't rehome a dead task in scx_cgroup_task_migrated

[Tejun Heo]

Hello,

On Tue, Aug 11, 2026 at 06:31:22PM +0800, Tao Cui wrote:
> A task can exit between cgroup migration commit and the MIGRATED callback:
> sched_ext_dead() marks it SCX_TASK_DEAD before cgroup_task_dead() removes it
> from the migration list, so scx_cgroup_task_migrated() can pick up a dead
> task and call scx_rehome_task(), which re-enables it and leaks the BPF
> scheduler's per-task resources. The other scx_rehome_task() callers already
> check for this; do the same here.

I don't think this window exists. SCX_TASK_DEAD is set only by
sched_ext_dead() from finish_task_switch(), which a task reaches only
after exit_signals(), and exit_signals() sets PF_EXITING inside
cgroup_threadgroup_change_begin(). The MIGRATED notifiers run inside
cgroup_migrate_execute() with the same rwsem write-held through
cgroup_attach_lock(), so no task in the set can enter the exit path
until the migration is done. Tasks which were already exiting are
filtered out by the PF_EXITING test in cgroup_migrate_add_task().

The DEAD tests you referenced are in scx_task_iter walks which run
without the threadgroup rwsem, where dying tasks can actually show up.

Did you try to reproduce the leak? When code review turns up a
suspected bug, it's a good idea to reproduce it first to verify the
assumptions before writing a fix.

Thanks.

--
tejun