Skip to contentSkip to conversation

sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path

PATCH Applied Tejun Heo 1 participant 2 messages May 11

Subsystems (3)
Stable branch Scheduler Scheduler - sched_ext
lore
Share & tools
lore

Tejun Heo

author reviewer
#0 lore raw

PATCH 1/1 sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path

In scx_root_enable_workfn(), put_task_struct(p) is called before scx_error() dereferences p->comm and p->pid. If the iterator's reference is the last drop, the task is freed synchronously and the deref becomes a UAF.

Move put_task_struct() past scx_error().

Reported-by Sashiko <[email protected]>
Closes https://lore.kernel.org/all/[email protected]/ open here
Fixes f0e1a0643a59 ("sched_ext: Implement BPF extensible scheduler class")
Cc [email protected] # v6.12+
Signed-off-by Tejun Heo <[email protected]>
---
 kernel/sched/ext.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/sched/ext.c +1 -1
index 1efd5d82b08b..9354da79e162 100644
@@ -6973,10 +6973,10 @@ static void scx_root_enable_workfn(struct kthread_work *work)
 			if (scx_get_task_state(p) != SCX_TASK_DEAD)
 				scx_set_task_state(p, SCX_TASK_NONE);
 			task_rq_unlock(rq, p, &rf);
-			put_task_struct(p);
 			scx_task_iter_stop(&sti);
 			scx_error(sch, "ops.init_task() failed (%d) for %s[%d]",
 				  ret, p->comm, p->pid);
+			put_task_struct(p);
 			goto err_disable_unlock_all;
 		}

--
2.49.1

author reviewer Applied
#1 lore raw

Applied to sched_ext/for-7.1-fixes.

Thanks.

--
tejun