linux-kernel - [GIT PULL] sched_ext: Fix for v6.19-rc8

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <403d62bc430249eb2904652103e4efa0@kernel.org>
Date: Wed, 04 Feb 2026 12:32:41 -1000
From: Tejun Heo <tj@...nel.org>
To: Linus Torvalds <torvalds@...ux-foundation.org>
Cc: David Vernet <void@...ifault.com>,
 Andrea Righi <arighi@...dia.com>,
 Changwoo Min <changwoo@...lia.com>,
 Emil Tsalapatis <emil@...alapatis.com>,
 sched-ext@...ts.linux.dev,
 linux-kernel@...r.kernel.org
Subject: [GIT PULL] sched_ext: Fix for v6.19-rc8

Hi, Linus.

This is a critical regression fix for a change introduced in this cycle.

The cgroup exit ordering fix (7900aa699c34) which moved sched_ext_free()
to finish_task_switch() created a race window where sched_class operations
could be invoked on dead tasks after sched_ext_dead() already ran, leading
to invalid SCX task state transitions and NULL pointer dereferences.

Thanks.

The following changes since commit c9894e6f0160414b57e895332c580cf5c8da6780:

  tools/sched_ext: update scx_show_state.py for scx_aborting change (2025-12-28 06:11:26 -1000)

are available in the Git repository at:

  https://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext.git tags/sched_ext-for-6.19-rc8-fixes

for you to fetch changes up to 0eca95cba2b7bf7b7b4f2fa90734a85fcaa72782:

  sched_ext: Short-circuit sched_class operations on dead tasks (2026-02-04 12:22:11 -1000)

----------------------------------------------------------------
sched_ext: Fixes for v6.19-rc8

- Fix race where sched_class operations (sched_setscheduler() and friends)
  could be invoked on dead tasks after sched_ext_dead() already ran, causing
  invalid SCX task state transitions and NULL pointer dereferences. This was
  a regression from the cgroup exit ordering fix which moved
  sched_ext_free() to finish_task_switch().

----------------------------------------------------------------
Tejun Heo (1):
      sched_ext: Short-circuit sched_class operations on dead tasks

 kernel/sched/ext.c | 48 ++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)

--
tejun