[PATCH] sched/rt: Fix NULL pointer dereference in task_is_throttled_rt()

[Aamir Ahmed]

When CONFIG_RT_GROUP_SCHED=y but RT group scheduling is disabled at
runtime (rt_group_sched=0 or CONFIG_RT_GROUP_SCHED_DEFAULT_DISABLED=y),
alloc_rt_sched_group() returns early and leaves tg->rt_rq == NULL for
non-root task groups; all RT entities are queued on the root rt_rq
instead (see set_task_rq()).

task_is_throttled_rt() still dereferences task_group(p)->rt_rq[cpu]
unconditionally, and the following WARN_ON() dereferences the result
again. With CONFIG_SCHED_CORE=y it is called for cookie-matched tasks
from sched_core_find()/sched_core_next() (pick, balance and steal
paths), so an RT task with a core cookie in a non-root cpu cgroup
oopses with the rq lock held.

Use the root rt_rq when RT group scheduling is disabled, matching
set_task_rq() and the !CONFIG_RT_GROUP_SCHED case, and drop the
WARN_ON() as it no longer checks anything.

Fixes: d6809c2f606c ("sched: Do not construct nor expose RT_GROUP_SCHED structures if disabled")
Signed-off-by: Aamir Ahmed <elb12345@xxxxxxxxxxxxx>
Cc: stable@xxxxxxxxxxxxxxx # v6.16+
---
 kernel/sched/rt.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c
index 1535046a23ff..87ea11b9194f 100644
--- a/kernel/sched/rt.c
+++ b/kernel/sched/rt.c
@@ -2592,8 +2592,14 @@ static int task_is_throttled_rt(struct task_struct *p, int cpu)
 	struct rt_rq *rt_rq;
 
 #ifdef CONFIG_RT_GROUP_SCHED // XXX maybe add task_rt_rq(), see also sched_rt_period_rt_rq
-	rt_rq = task_group(p)->rt_rq[cpu];
-	WARN_ON(!rt_group_sched_enabled() && rt_rq->tg != &root_task_group);
+	/*
+	 * With RT group scheduling disabled at runtime, non-root task
+	 * groups have no rt_rq; all RT tasks live on the root rt_rq.
+	 */
+	if (rt_group_sched_enabled())
+		rt_rq = task_group(p)->rt_rq[cpu];
+	else
+		rt_rq = &cpu_rq(cpu)->rt;
 #else
 	rt_rq = &cpu_rq(cpu)->rt;
 #endif
-- 
2.55.0