[PATCH 1/2] sched_ext: Use rcu_dereference() for scx_root in dump paths

[David Carlier]

scx_dump_task() and scx_dump_state() read scx_root directly without
rcu_dereference() or NULL check. If the BPF scheduler is torn down
concurrently, scx_root can become NULL between the read and the
dereference in SCX_HAS_OP(), causing a NULL pointer dereference.

Use rcu_dereference() to properly access scx_root under RCU protection
and bail out early if it is NULL.

Signed-off-by: David Carlier <devnexen@xxxxxxxxx>
---
 kernel/sched/ext.c | 28 ++++++++++++++++++++++++++--
 1 file changed, 26 insertions(+), 2 deletions(-)

diff --git a/kernel/sched/ext.c b/kernel/sched/ext.c
index 9280381f8923..eb539b671c49 100644
--- a/kernel/sched/ext.c
+++ b/kernel/sched/ext.c
@@ -4580,7 +4580,19 @@ static void scx_dump_task(struct seq_buf *s, struct scx_dump_ctx *dctx,
 			  struct task_struct *p, char marker)
 {
 	static unsigned long bt[SCX_EXIT_BT_LEN];
-	struct scx_sched *sch = scx_root;
+	struct scx_sched *sch;
+
+	/*
+	 * The BPF scheduler can be torn down concurrently
+	 */
+	rcu_read_lock();
+	sch = rcu_dereference(scx_root);
+	if (!sch) {
+		rcu_read_unlock();
+		return;
+	}
+	rcu_read_unlock();
+
 	char dsq_id_buf[19] = "(n/a)";
 	unsigned long ops_state = atomic_long_read(&p->scx.ops_state);
 	unsigned int bt_len = 0;
@@ -4623,7 +4635,19 @@ static void scx_dump_state(struct scx_exit_info *ei, size_t dump_len)
 {
 	static DEFINE_SPINLOCK(dump_lock);
 	static const char trunc_marker[] = "\n\n~~~~ TRUNCATED ~~~~\n";
-	struct scx_sched *sch = scx_root;
+	struct scx_sched *sch;
+
+	/*
+	 * The BPF scheduler can be torn down concurrently
+	 */
+	rcu_read_lock();
+	sch = rcu_dereference(scx_root);
+	if (!sch) {
+		rcu_read_unlock();
+		return;
+	}
+	rcu_read_unlock();
+
 	struct scx_dump_ctx dctx = {
 		.kind = ei->kind,
 		.exit_code = ei->exit_code,
-- 
2.51.0