Re: [PATCHSET sched_ext/for-7.2-fixes] sched_ext: Assorted sub-scheduler and cgroup fixes

[Tejun Heo]

Hello, Andrea.

On Fri, Jul 17, 2026 at 11:11:10AM +0200, Andrea Righi wrote:
> I randomly triggered the following with this applied, but it looks unrelated to
> these changes:
...
> This might be a pre-existent bug, I'll investigate a bit.

It is pre-existing. Cgroup migration doesn't update p->scx.sched, so a
task moved out of a sub-scheduler's cgroup keeps pointing at it. The
sub-scheduler's disable path only walks its own subtree and misses the
task, and the task ends up holding a dangling pointer once the scheduler
is freed. In your crash, the watchdog read a garbage timeout from the
recycled memory, declared a stall, and the exit propagation then chased
a garbage ->children pointer into scx_claim_exit().

Reproducer, on this branch, KASAN reports use-after-free within seconds:

1. Run scx_qmap.
2. Put a CPU hog in cgroup A.
3. scx_qmap -c /sys/fs/cgroup/A
4. Move the hog to a different cgroup.
5. Kill the sub-scheduler.

I have a fix series which re-homes tasks on cgroup migration in the
works and will post it soon.

Thanks.

--
tejun