Re: [PATCH v3 sched_ext/for-7.3 28/36] sched_ext: Tie cpu occupancy to SCX_CAP_BASE through the task slice

[Tejun Heo]

On Tue, 07 Jul 2026 00:38:21 +0000, sashiko-bot@xxxxxxxxxx wrote:
> - [High] A TOCTOU race in `scx_bpf_task_set_slice()` allows a BPF scheduler to corrupt a task's CPU slice and bypass capability revocation.

Real. A remote wakeup migrates a sleeping task via select_task_rq()
under pi_lock only (the one cpu change not under the source rq lock), so
the cached task_rq() can still equal the locked rq while the task is
elsewhere. Fixed with a runnable_cpu stamp maintained under the rq lock
and cleared on leave, checked in place of the cached rq.

Thanks.

-- 
tejun