Commit 80afd4c8 authored by Tejun Heo's avatar Tejun Heo
Browse files

sched_ext: Read scx_root under scx_cgroup_ops_rwsem in cgroup setters 



scx_group_set_{weight,idle,bandwidth}() cache scx_root before acquiring
scx_cgroup_ops_rwsem, so the pointer can be stale by the time the op runs.
If the loaded scheduler is disabled and freed (via RCU work) and another is
enabled between the naked load and the rwsem acquire, the reader sees
scx_cgroup_enabled=true (the new scheduler's) but dereferences the freed one
- UAF on SCX_HAS_OP(sch, ...) / SCX_CALL_OP(sch, ...).

scx_cgroup_enabled is toggled only under scx_cgroup_ops_rwsem write
(scx_cgroup_{init,exit}), so reading scx_root inside the rwsem read section
correlates @sch with the enabled snapshot.

Fixes: a5bd6ba3 ("sched_ext: Use cgroup_lock/unlock() to synchronize against cgroup operations")
Cc: stable@vger.kernel.org # v6.18+
Reported-by: default avatarChris Mason <clm@meta.com>
Signed-off-by: default avatarTejun Heo <tj@kernel.org>
Reviewed-by: default avatarAndrea Righi <arighi@nvidia.com>
parent 21a5a97b

kernel/sched/ext.c

+6 −3
Original line number Diff line number Diff line
@@ -4343,9 +4343,10 @@ void scx_cgroup_cancel_attach(struct cgroup_taskset *tset) 


void scx_group_set_weight(struct task_group *tg, unsigned long weight)

{

	struct scx_sched *sch = scx_root;

	struct scx_sched *sch;



	percpu_down_read(&scx_cgroup_ops_rwsem);

	sch = scx_root;



	if (scx_cgroup_enabled && SCX_HAS_OP(sch, cgroup_set_weight) &&

	    tg->scx.weight != weight)
@@ -4358,9 +4359,10 @@ void scx_group_set_weight(struct task_group *tg, unsigned long weight) 


void scx_group_set_idle(struct task_group *tg, bool idle)

{

	struct scx_sched *sch = scx_root;

	struct scx_sched *sch;



	percpu_down_read(&scx_cgroup_ops_rwsem);

	sch = scx_root;



	if (scx_cgroup_enabled && SCX_HAS_OP(sch, cgroup_set_idle))

		SCX_CALL_OP(sch, cgroup_set_idle, NULL, tg_cgrp(tg), idle);
@@ -4374,9 +4376,10 @@ void scx_group_set_idle(struct task_group *tg, bool idle) 
void scx_group_set_bandwidth(struct task_group *tg,

			     u64 period_us, u64 quota_us, u64 burst_us)

{

	struct scx_sched *sch = scx_root;

	struct scx_sched *sch;



	percpu_down_read(&scx_cgroup_ops_rwsem);

	sch = scx_root;



	if (scx_cgroup_enabled && SCX_HAS_OP(sch, cgroup_set_bandwidth) &&

	    (tg->scx.bw_period_us != period_us ||