[PATCH v1] sched_ext: finish scheduler init before publishing ops priv

[Binbin Deng]

scx_alloc_and_add_sched() assigns ops->priv before initializing the
scheduler's kobject, list linkage, and sub-scheduler kset, and before
consuming the BPF arena reference.  BPF kfuncs resolve the scheduler with
scx_prog_sched(), whose readers dereference ops->priv under RCU.  Once the
pointer is published, a program can therefore use fields that the creation
path has not initialized yet.

Attach a sched_ext struct_ops program that reaches one of those kfuncs
while registration is still completing.  Delay publication until after all
failure-prone initialization and arena setup have succeeded and
cmd->arena_map has been transferred to the scheduler.

Found during a static-analysis-assisted audit: candidate sites were
surfaced by a Coccinelle rule, and the reader/writer paths were
confirmed by LLM-assisted (GLM-5.3) code inspection.  The issue was
not observed at runtime; it is identified by code inspection only.

Fixes: 105dcd005be2 ("sched_ext: Introduce scx_prog_sched()")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Binbin Deng <18983559317@xxxxxxx>
---
 kernel/sched/ext/ext.c | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/kernel/sched/ext/ext.c b/kernel/sched/ext/ext.c
index 3219f0da0fe4..bd79bb692cb9 100644
--- a/kernel/sched/ext/ext.c
+++ b/kernel/sched/ext/ext.c
@@ -7305,13 +7305,6 @@ struct scx_sched *scx_alloc_and_add_sched(struct scx_enable_cmd *cmd,
 	INIT_LIST_HEAD(&sch->sibling);
 #endif	/* CONFIG_EXT_SUB_SCHED */
 
-	/*
-	 * Publishing makes @sch visible to scx_prog_sched() readers. Failure
-	 * paths after this point must free @sch through kobject_put() whose
-	 * release path defers the actual freeing by an RCU grace period.
-	 */
-	rcu_assign_pointer(ops->priv, sch);
-
 	sch->kobj.kset = scx_kset;
 	INIT_LIST_HEAD(&sch->all);
 
@@ -7345,6 +7338,14 @@ struct scx_sched *scx_alloc_and_add_sched(struct scx_enable_cmd *cmd,
 		sch->arena_kern_base = bpf_arena_map_kern_vm_start(sch->arena_map);
 #endif
 	cmd->arena_map = NULL;
+
+	/*
+	 * Publishing makes @sch visible to scx_prog_sched() readers. Failure
+	 * paths after this point must free @sch through kobject_put() whose
+	 * release path defers the actual freeing by an RCU grace period.
+	 */
+	rcu_assign_pointer(ops->priv, sch);
+
 	return sch;
 
 #ifdef CONFIG_EXT_SUB_SCHED
-- 
2.43.0