[PATCH bpf-next] sched_ext: Reset task fields on exit of an SCX_TASK_READY task

[Rahad Bhuiya]

Commit a298fd5f4ee8 ("sched_ext: Fix use-after-free of a NONE rescuee
leaving its sched while running") moved the reset of SCX-managed fields
out of scx_disable_task() into scx_reset_task_fields() so that it can be
invoked on every path where a task leaves its scheduler's control,
including tasks in SCX_TASK_NONE.

However, in __scx_disable_and_exit_task(), an exiting task in state
SCX_TASK_READY (e.g., a forked task that was initialized via
ops.init_task() but never enabled under an ext_sched_class before exiting,
or a disabled task) currently breaks out of the state switch without
calling scx_reset_task_fields().

Consequently, its managed fields (vtime, slice, reenqueue flags, and
watchdog runnable_at reset) are not reset, violating the invariant that a
task leaving its scheduler's control starts clean.

Call scx_reset_task_fields() in the SCX_TASK_READY case of
__scx_disable_and_exit_task() to ensure consistent cleanup across all exit
paths.

Fixes: a298fd5f4ee8 ("sched_ext: Fix use-after-free of a NONE rescuee leaving its sched while running")
Signed-off-by: Rahad Bhuiya <rahadbhuiya2021@xxxxxxxxx>
---
 kernel/sched/ext/ext.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/kernel/sched/ext/ext.c b/kernel/sched/ext/ext.c
index f74ffb3b1aca..b57a7989f304 100644
--- a/kernel/sched/ext/ext.c
+++ b/kernel/sched/ext/ext.c
@@ -4728,6 +4728,7 @@ void __scx_disable_and_exit_task(struct scx_sched *sch, struct task_struct *p)
 		args.cancelled = true;
 		break;
 	case SCX_TASK_READY:
+		scx_reset_task_fields(task_rq(p), p);
 		break;
 	case SCX_TASK_ENABLED:
 		scx_disable_task(sch, p);
-- 
2.55.0.windows.3