Re: [PATCH 1/2] sched_ext: Use rcu_dereference() for scx_root in dump paths

[Tejun Heo]

Hello,

On Thu, Feb 26, 2026 at 05:26:39AM +0000, David Carlier wrote:
> scx_dump_task() and scx_dump_state() read scx_root directly without
> rcu_dereference() or NULL check. If the BPF scheduler is torn down
> concurrently, scx_root can become NULL between the read and the
> dereference in SCX_HAS_OP(), causing a NULL pointer dereference.

scx_dump_state() is called from scx_error_irq_workfn() and
sysrq_handle_sched_ext_dump(). SCX can't turn off before dump is complete in
the former case. In the latter, scx_enabled() gates the call and it's in the
irq context. When scx_enabled() turns off, there's synchronize_rcu() call
afterwards before anything happens to scx_root. ie. It cannot go away in
flight. This is the same synchronization that protect other in-flight sched
ops.

Thanks.

-- 
tejun