Re: [PATCH] sched_ext: Fix NULL pointer deref and warnings during scx teardown

[Andrea Righi]

On Mon, Feb 02, 2026 at 07:10:02AM -1000, Tejun Heo wrote:
> Hello,
> 
> On Mon, Feb 02, 2026 at 04:13:41PM +0100, Andrea Righi wrote:
> > @@ -2619,6 +2619,9 @@ static void set_cpus_allowed_scx(struct task_struct *p,
> >  
> >  	set_cpus_allowed_common(p, ac);
> >  
> > +	if (unlikely(!sch))
> > +		return;
> > +
> 
> I don't quite understand how this would happen. set_cpu_allowed_scx() is
> called from do_set_cpus_allowed() with task_rq locked. ie. the task *has* to
> be on sched_ext for it to be called. It's straightforward task rq lock
> synchronization, so there's no race window.
> 
> Combined with the failures in switching_to_scx() and switched_form_scx(), I
> wonder whether what's actually broken is more something like the disable
> path missing some tasks?
> 
> Thanks.
> 
> -- 
> tejun

I'm able to reproduce the NULL pointer dereference in set_cpu_allowed_scx()
quite easily running `stress-ng --race-sched 0` with an scx scheduler that
is intentionally starving tasks, triggering a stall => disable.

I think this is what's happening:

 CPU0                                      CPU1
 ----                                      ----
 __sched_setscheduler()
   task_rq_lock(p)

   next_class = __setscheduler_class()
     // next_class is ext_sched_class
                                           scx_disable_workfn()
                                             scx_set_enable_state(SCX_DISABLING)

                                             scx_task_iter_start()
                                             while ((p = next())) {
					       ...
                                               p->sched_class = fair_sched_class
					       ...
                                             }
                                             scx_task_iter_stop()

                                             synchronize_rcu()
                                             RCU_INIT_POINTER(scx_root, NULL)

   scoped_guard(sched_change, ...) {
     p->sched_class = next_class;
       // next_class is still ext_sched_class,
       // overwriting fair_sched_class!
   }
   // Guard ends, calls sched_change_end()
   //   switching_to_scx() called
   //   scx_root == NULL => returns early

   task_rq_unlock(p)

   sched_setaffinity(p)
     set_cpus_allowed_scx()
       sch = scx_root; // scx_root == NULL => BUG!

-Andrea