Commit 86ecb1c1 authored by Andrea Righi's avatar Andrea Righi Committed by Tejun Heo
Browse files

sched_ext: Clear ops->priv on scx_alloc_and_add_sched() error paths 



scx_alloc_and_add_sched() can fail after @sch has been assigned to
ops->priv. In those cases @sch is torn down (either via kfree() through
the err_free_* chain or via kobject_put() -> scx_kobj_release() -> RCU
work), but @ops->priv is left pointing at the about-to-be-freed pointer.

With the recent -EBUSY gate in scx_root_enable_workfn() and
scx_sub_enable_workfn() that rejects an attach when @ops->priv is still
non-NULL, see commit bbf30b38 ("sched_ext: Fix ops->priv clobber on
concurrent attach/detach"), a dangling @ops->priv permanently locks the
kdata out: every future attach attempt sees a stale binding and returns
-EBUSY even though no scheduler is actually attached.

Clear @ops->priv on the post-assign failure paths so that the kdata
returns to its pre-attach state when the function returns ERR_PTR().

Fixes: bbf30b38 ("sched_ext: Fix ops->priv clobber on concurrent attach/detach")
Suggested-by: default avatarTejun Heo <tj@kernel.org>
Signed-off-by: default avatarAndrea Righi <arighi@nvidia.com>
Signed-off-by: default avatarTejun Heo <tj@kernel.org>
parent bbf30b38

kernel/sched/ext.c

+4 −0
Original line number Diff line number Diff line
@@ -6670,6 +6670,7 @@ static struct scx_sched *scx_alloc_and_add_sched(struct sched_ext_ops *ops, 
		ret = kobject_init_and_add(&sch->kobj, &scx_ktype, NULL, "root");



	if (ret < 0) {

		RCU_INIT_POINTER(ops->priv, NULL);

		kobject_put(&sch->kobj);

		return ERR_PTR(ret);

	}
@@ -6677,6 +6678,7 @@ static struct scx_sched *scx_alloc_and_add_sched(struct sched_ext_ops *ops, 
	if (ops->sub_attach) {

		sch->sub_kset = kset_create_and_add("sub", NULL, &sch->kobj);

		if (!sch->sub_kset) {

			RCU_INIT_POINTER(ops->priv, NULL);

			kobject_put(&sch->kobj);

			return ERR_PTR(-ENOMEM);

		}
@@ -6684,6 +6686,7 @@ static struct scx_sched *scx_alloc_and_add_sched(struct sched_ext_ops *ops, 
#else	/* CONFIG_EXT_SUB_SCHED */

	ret = kobject_init_and_add(&sch->kobj, &scx_ktype, NULL, "root");

	if (ret < 0) {

		RCU_INIT_POINTER(ops->priv, NULL);

		kobject_put(&sch->kobj);

		return ERR_PTR(ret);

	}
@@ -6692,6 +6695,7 @@ static struct scx_sched *scx_alloc_and_add_sched(struct sched_ext_ops *ops, 


#ifdef CONFIG_EXT_SUB_SCHED

err_free_lb_resched:

	RCU_INIT_POINTER(ops->priv, NULL);

	free_cpumask_var(sch->bypass_lb_resched_cpumask);

#endif

err_free_lb_cpumask: