From nobody Tue Sep 29 13:20:15 2026 Received: from m16.mail.163.com (m16.mail.163.com [117.135.210.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3D82A394792 for ; Fri, 7 Aug 2026 09:39:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=117.135.210.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786095562; cv=none; b=gqE6ZHNt263pRFr/KIRB/PtudMYFY1h32e00bBfJ0HUW9xSD9vbzCR/tnmsIJokQ9Q1w4FcfFbscudaEsZDyfnhIP6bzHCEV7tIh6CaRshRrLzfnHvrIViZbdWXr1ZBZNOfnzbR6S03VuI/Z7wAX3cv1X/4V0VYn9VXFKDu7L5o= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786095562; c=relaxed/simple; bh=89jGM4c+vn3KA93xdHQb/fkqCpfxHpQEbGtAld1RZiE=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=ROHDSfVvCqU1vMVJg+sULQ6uugdRNhmm3nikwhZ2apO9de23+/nNj6l/kGjzEntXXbe1AmsspLx5AaZGpKry01iU19VvMDCKWHj42LArK+8wijFOmg4Dlq51g4DKnnFCYNTyjuNxUr3BJUxMh33jAWSVPW3V+hQmbBMUu4tx4Y4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=163.com; spf=pass smtp.mailfrom=163.com; dkim=pass (1024-bit key) header.d=163.com header.i=@163.com header.b=GXTOINrp; arc=none smtp.client-ip=117.135.210.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=163.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=163.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=163.com header.i=@163.com header.b="GXTOINrp" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=163.com; s=s110527; h=From:To:Subject:Date:Message-Id:MIME-Version; bh=Jz XIef971cDIJl/krmt8IkgIud1AvEsYTj+se2y0TPA=; b=GXTOINrpM9TSs2saaI vGw1LnfCvjcZnRNQHUt5ECRpfVmJbSfH55yTPkGsormxpcdsF0uGgWUkuc1NiPNh t7m4AI1khBoBYveOONkTXNqCsWlIfqGGU1xLtF8JI0MInTdidZRj0OgQ4SZHjyRu iBOtPgkLvKDu6/AygIIhEHriQ= Received: from cuijian-virtual-machine.localdomain (unknown []) by gzga-smtp-mtada-g1-3 (Coremail) with SMTP id _____wDnyACep3Vq64SUMQ--.116S2; Fri, 07 Aug 2026 17:38:40 +0800 (CST) From: Cui Jian To: Tejun Heo Cc: David Vernet , Andrea Righi , Changwoo Min , sched-ext@lists.linux.dev, linux-kernel@vger.kernel.org, Cui Jian Subject: [PATCH] sched_ext: Fix NULL dereference in find_parent_sched() Date: Fri, 7 Aug 2026 17:38:37 +0800 Message-Id: <20260807093838.56002-1-cjian720@163.com> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: _____wDnyACep3Vq64SUMQ--.116S2 X-Coremail-Antispam: 1Uf129KBjvdXoW7GryfGr4xAF1DuF1DXr4ruFg_yoWfKrc_Zw 13Ga15G34UAr1DKw429398ZrWfKFW2kryrZF9FkFW3JF1kJrZxXr1fCF95t3sIkFWxXFyD Gr9IkFykArn7CjkaLaAFLSUrUUUUjb8apTn2vfkv8UJUUUU8Yxn0WfASr-VFAUDa7-sFnT 9fnUUvcSsGvfC2KfnxnUUI43ZEXa7sREID75UUUUU== X-CM-SenderInfo: pfmlt0qxsqqiywtou0bp/xtbC3AAKlmp1p6B1XAAA3x Content-Type: text/plain; charset="utf-8" find_parent_sched() dereferences cgrp->scx_sched without checking for NULL. cgroup_get_from_id() can return cgroups from any hierarchy, including cgroup v1 where scx_sched is never set. A BPF program that passes a v1 cgroup ID as sub_cgroup_id would hit parent->cgrp on a NULL pointer and crash the kernel. Add a NULL check and return -ENODEV. Signed-off-by: Cui Jian --- kernel/sched/ext/sub.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/kernel/sched/ext/sub.c b/kernel/sched/ext/sub.c index d7842a609d96..6395281bae71 100644 --- a/kernel/sched/ext/sub.c +++ b/kernel/sched/ext/sub.c @@ -1209,6 +1209,10 @@ static struct scx_sched *find_parent_sched(struct cg= roup *cgrp) =20 lockdep_assert_held(&scx_sched_lock); =20 + /* no SCX sched */ + if (!parent) + return ERR_PTR(-ENODEV); + /* can't attach twice to the same cgroup */ if (parent->cgrp =3D=3D cgrp) return ERR_PTR(-EBUSY); --=20 2.34.1