diff options
| author | Tejun Heo <tj@kernel.org> | 2026-05-12 01:05:48 +0300 |
|---|---|---|
| committer | Tejun Heo <tj@kernel.org> | 2026-05-12 01:05:48 +0300 |
| commit | 9a415cc53711f2238e0f0ca8a6bcc796c003b127 (patch) | |
| tree | 01457067f3d0db705e447ca715917d56033ac764 | |
| parent | 86ecb1c1a1f5c1bf4a45b91f54f8220c3121bd3b (diff) | |
| download | linux-9a415cc53711f2238e0f0ca8a6bcc796c003b127.tar.xz | |
sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path
In scx_root_enable_workfn(), put_task_struct(p) is called before scx_error()
dereferences p->comm and p->pid. If the iterator's reference is the last
drop, the task is freed synchronously and the deref becomes a UAF.
Move put_task_struct() past scx_error().
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/all/20260511214031.AF5E9C2BCB0@smtp.kernel.org/
Fixes: f0e1a0643a59 ("sched_ext: Implement BPF extensible scheduler class")
Cc: stable@vger.kernel.org # v6.12+
Signed-off-by: Tejun Heo <tj@kernel.org>
| -rw-r--r-- | kernel/sched/ext.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/kernel/sched/ext.c b/kernel/sched/ext.c index 1efd5d82b08b..9354da79e162 100644 --- a/kernel/sched/ext.c +++ b/kernel/sched/ext.c @@ -6973,10 +6973,10 @@ static void scx_root_enable_workfn(struct kthread_work *work) if (scx_get_task_state(p) != SCX_TASK_DEAD) scx_set_task_state(p, SCX_TASK_NONE); task_rq_unlock(rq, p, &rf); - put_task_struct(p); scx_task_iter_stop(&sti); scx_error(sch, "ops.init_task() failed (%d) for %s[%d]", ret, p->comm, p->pid); + put_task_struct(p); goto err_disable_unlock_all; } |