Re: [PATCHSET sched_ext/for-7.2-fixes] sched_ext: Assorted sub-scheduler and cgroup fixes

[Andrea Righi]

On Fri, Jul 17, 2026 at 06:12:06PM -1000, Tejun Heo wrote:
> Hello, Andrea.
> 
> On Fri, Jul 17, 2026 at 11:11:10AM +0200, Andrea Righi wrote:
> > I randomly triggered the following with this applied, but it looks unrelated to
> > these changes:
> ...
> > This might be a pre-existent bug, I'll investigate a bit.
> 
> It is pre-existing. Cgroup migration doesn't update p->scx.sched, so a
> task moved out of a sub-scheduler's cgroup keeps pointing at it. The
> sub-scheduler's disable path only walks its own subtree and misses the
> task, and the task ends up holding a dangling pointer once the scheduler
> is freed. In your crash, the watchdog read a garbage timeout from the
> recycled memory, declared a stall, and the exit propagation then chased
> a garbage ->children pointer into scx_claim_exit().
> 
> Reproducer, on this branch, KASAN reports use-after-free within seconds:
> 
> 1. Run scx_qmap.
> 2. Put a CPU hog in cgroup A.
> 3. scx_qmap -c /sys/fs/cgroup/A
> 4. Move the hog to a different cgroup.
> 5. Kill the sub-scheduler.
> 
> I have a fix series which re-homes tasks on cgroup migration in the
> works and will post it soon.

Oh I see, thanks for the details. About this patch series, everything looks good
to me, so:

Reviewed-by: Andrea Righi <arighi@xxxxxxxxxx>

-Andrea