c941d7391f
scx_root_enable_workfn() drops the iter rq lock for ops.init_task() and a TASK_DEAD @p can fall through sched_ext_dead() in that window. The race hits when sched_ext_dead() observes SCX_TASK_INIT (the intermediate state before @p->scx.sched is published) and dereferences NULL via SCX_HAS_OP(NULL, exit_task), or observes SCX_TASK_NONE during the unlocked init window and skips cleanup so exit_task() never runs. Add SCX_TASK_INIT_BEGIN. The enable path writes NONE -> INIT_BEGIN under the iter rq lock, then takes the rq lock again after init to walk INIT_BEGIN -> INIT -> READY. sched_ext_dead() that wins the rq-lock race observes INIT_BEGIN and sets DEAD without calling into ops; the post-init recheck unwinds via scx_sub_init_cancel_task(). scx_fork() runs single-threaded against sched_ext_dead() (the task is not on scx_tasks until scx_post_fork() adds it) so its INIT_BEGIN -> INIT walk needs no rq-lock pairing; it rolls back to NONE on ops.init_task() failure. The validation matrix grows the INIT_BEGIN row and the INIT_BEGIN -> DEAD edge; INIT now requires INIT_BEGIN as the predecessor. scx_sub_disable()'s migration writes INIT_BEGIN as a synthetic predecessor to satisfy the tightened verification. The sub-sched paths still race with sched_ext_dead() during the unlocked init window. This will be fixed by the next patch. Reported-by: zhidao su <suzhidao@xiaomi.com> Link: https://lore.kernel.org/all/20260429133155.3825247-1-suzhidao@xiaomi.com/ Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Andrea Righi <arighi@nvidia.com> |
||
|---|---|---|
| .. | ||
| affinity.h | ||
| autogroup.h | ||
| clock.h | ||
| cond_resched.h | ||
| coredump.h | ||
| cpufreq.h | ||
| cputime.h | ||
| deadline.h | ||
| debug.h | ||
| ext.h | ||
| hotplug.h | ||
| idle.h | ||
| init.h | ||
| isolation.h | ||
| jobctl.h | ||
| loadavg.h | ||
| mm.h | ||
| nohz.h | ||
| numa_balancing.h | ||
| posix-timers.h | ||
| prio.h | ||
| rseq_api.h | ||
| rt.h | ||
| sd_flags.h | ||
| signal.h | ||
| smt.h | ||
| stat.h | ||
| sysctl.h | ||
| task.h | ||
| task_flags.h | ||
| task_stack.h | ||
| thread_info_api.h | ||
| topology.h | ||
| types.h | ||
| user.h | ||
| vhost_task.h | ||
| wake_q.h | ||
| xacct.h | ||