[PATCH 2/2] sched_ext: Fix TOCTOU on p->scx.dsq in scx_dump_task()

[David Carlier]

p->scx.dsq is checked for NULL then dereferenced without
synchronization. Another CPU can NULL the pointer between the check
and the use. Use READ_ONCE() to capture the pointer into a local
variable before dereferencing.

Signed-off-by: David Carlier <devnexen@xxxxxxxxx>
---
 kernel/sched/ext.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/kernel/sched/ext.c b/kernel/sched/ext.c
index eb539b671c49..444398f3686a 100644
--- a/kernel/sched/ext.c
+++ b/kernel/sched/ext.c
@@ -4597,9 +4597,11 @@ static void scx_dump_task(struct seq_buf *s, struct scx_dump_ctx *dctx,
 	unsigned long ops_state = atomic_long_read(&p->scx.ops_state);
 	unsigned int bt_len = 0;
 
-	if (p->scx.dsq)
+	struct scx_dispatch_q *dsq = READ_ONCE(p->scx.dsq);
+
+	if (dsq)
 		scnprintf(dsq_id_buf, sizeof(dsq_id_buf), "0x%llx",
-			  (unsigned long long)p->scx.dsq->id);
+			  (unsigned long long)dsq->id);
 
 	dump_newline(s);
 	dump_line(s, " %c%c %s[%d] %+ldms",
-- 
2.51.0