Re: [PATCHSET sched_ext/for-7.3] sched_ext: Cgroup migration and op delivery for sub-schedulers

[Andrea Righi]

Hi Tejun,

On Fri, Jul 17, 2026 at 10:17:19PM -1000, Tejun Heo wrote:
> Hello,
> 
> A task's sched must match its cgroup's: each sub-scheduler serves the
> cgroup2 subtree it is attached to and the root scheduler serves the rest.
> Cgroup migration currently breaks this. A task moved across a
> sub-scheduler boundary keeps its old sched, leading to wrong-sched
> scheduling and, once the stale sched is freed, a use-after-free. Cgroup
> ops are also always delivered to the root scheduler no matter which sched
> serves the cgroup.
> 
> This patchset makes both follow the sub-scheduler topology:
> 
> - cgroup gains a task migration notifier (0001). sched_ext uses it to
>   re-home tasks whose migration crosses a sched boundary: the destination
>   sched runs the fallible ops.init_task() before the migration commits,
>   so a rejection fails the cgroup.procs write (0002-0004).
> 
> - cgroup_init/exit and the knob ops are delivered to the sched each
>   task_group is on. The move ops go to the task's sched, only for
>   migrations that don't re-home it (0005).
> 
> - Sub-scheduler enable claims the subtree's cgroups from the parent and
>   disable returns them. A parent that fails to re-init a returned cgroup
>   fails in turn and the cgroups move up the chain, ending at the root
>   scheduler (0006).
> 
> - scx_qmap consumes cgroup weights through ops.cgroup_set_weight() and
>   gains fault injection modes to exercise the failure paths (0007-0008).
> 
> Verified with a trace-based suite on the demo scheduler covering op
> delivery and routing, handover failures, multi-level punt chains, cgroup1
> and stress.

I left a comment on PATCH 4/8, but overall the series looks good to me.

I also confirm that, with this applied, I can no longer reproduce the
use-after-free triggered by moving a task out of a sub-scheduler's cgroup and
then terminating the sub-scheduler.

Reviewed-by: Andrea Righi <arighi@xxxxxxxxxx>

Thanks,
-Andrea

> 
> Based on sched_ext/for-7.3 (7c2cd767705d).
> 
> Tejun Heo (8):
>   cgroup: Add cgroup_task_notifier and task migration events
>   sched_ext: Factor out scx_rehome_task() and scx_punt_task()
>   sched_ext: Relocate scx_cgroup_enabled
>   sched_ext: Re-home tasks on cgroup migration
>   sched_ext: Deliver cgroup ops to each task_group's sched
>   sched_ext: Hand over cgroups at sub-scheduler enable/disable
>   tools/sched_ext: scx_qmap - Consume cgroup weights through set_weight
>   tools/sched_ext: scx_qmap - Add init fault injection modes
> 
> Git tree: git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext.git scx-cgroup-migration
> 
>  include/linux/cgroup.h         |  26 +++
>  include/linux/sched/ext.h      |  15 ++
>  kernel/cgroup/cgroup.c         |  93 ++++++++-
>  kernel/sched/ext/ext.c         | 247 +++++++++++++++++-------
>  kernel/sched/ext/internal.h    |  44 ++++-
>  kernel/sched/ext/sub.c         | 418 +++++++++++++++++++++++++++++++++++++----
>  tools/sched_ext/scx_qmap.bpf.c |  95 ++++++++--
>  tools/sched_ext/scx_qmap.c     | 110 +----------
>  tools/sched_ext/scx_qmap.h     |   5 +-
>  9 files changed, 819 insertions(+), 234 deletions(-)
> 
> --
> tejun