From: Tao Cui <cuitao@kylinos.cn>

A task can exit between cgroup migration commit and the MIGRATED callback:
sched_ext_dead() marks it SCX_TASK_DEAD before cgroup_task_dead() removes it
from the migration list, so scx_cgroup_task_migrated() can pick up a dead
task and call scx_rehome_task(), which re-enables it and leaks the BPF
scheduler's per-task resources. The other scx_rehome_task() callers already
check for this; do the same here.

Fixes: bf9dee58ab56 ("sched_ext: Re-home tasks on cgroup migration")
Signed-off-by: Tao Cui <cuitao@kylinos.cn>
---
 kernel/sched/ext/sub.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/kernel/sched/ext/sub.c b/kernel/sched/ext/sub.c
index b81254be1b04..8f8d21b85abe 100644
--- a/kernel/sched/ext/sub.c
+++ b/kernel/sched/ext/sub.c
@@ -2083,6 +2083,13 @@ static void scx_cgroup_task_migrated(struct cgroup_task_migrate_ctx *ctx)
 		return;
 
 	rq = task_rq_lock(p, &rf);
+
+	if (scx_get_task_state(p) == SCX_TASK_DEAD) {
+		/* sched_ext_dead() raced us */
+		task_rq_unlock(rq, p, &rf);
+		return;
+	}
+
 	scx_rehome_task(to, p);
 	task_rq_unlock(rq, p, &rf);
 }
-- 
2.43.0

Hello,

On Tue, Aug 11, 2026 at 06:31:22PM +0800, Tao Cui wrote:
> A task can exit between cgroup migration commit and the MIGRATED callback:
> sched_ext_dead() marks it SCX_TASK_DEAD before cgroup_task_dead() removes it
> from the migration list, so scx_cgroup_task_migrated() can pick up a dead
> task and call scx_rehome_task(), which re-enables it and leaks the BPF
> scheduler's per-task resources. The other scx_rehome_task() callers already
> check for this; do the same here.

I don't think this window exists. SCX_TASK_DEAD is set only by
sched_ext_dead() from finish_task_switch(), which a task reaches only
after exit_signals(), and exit_signals() sets PF_EXITING inside
cgroup_threadgroup_change_begin(). The MIGRATED notifiers run inside
cgroup_migrate_execute() with the same rwsem write-held through
cgroup_attach_lock(), so no task in the set can enter the exit path
until the migration is done. Tasks which were already exiting are
filtered out by the PF_EXITING test in cgroup_migrate_add_task().

The DEAD tests you referenced are in scx_task_iter walks which run
without the threadgroup rwsem, where dying tasks can actually show up.

Did you try to reproduce the leak? When code review turns up a
suspected bug, it's a good idea to reproduce it first to verify the
assumptions before writing a fix.

Thanks.

--
tejun

Hi,

在 2026/8/15 03:04, Tejun Heo 写道:
> Hello,
> 
> On Tue, Aug 11, 2026 at 06:31:22PM +0800, Tao Cui wrote:
>> A task can exit between cgroup migration commit and the MIGRATED callback:
>> sched_ext_dead() marks it SCX_TASK_DEAD before cgroup_task_dead() removes it
>> from the migration list, so scx_cgroup_task_migrated() can pick up a dead
>> task and call scx_rehome_task(), which re-enables it and leaks the BPF
>> scheduler's per-task resources. The other scx_rehome_task() callers already
>> check for this; do the same here.
> 
> I don't think this window exists. SCX_TASK_DEAD is set only by
> sched_ext_dead() from finish_task_switch(), which a task reaches only
> after exit_signals(), and exit_signals() sets PF_EXITING inside
> cgroup_threadgroup_change_begin(). The MIGRATED notifiers run inside
> cgroup_migrate_execute() with the same rwsem write-held through
> cgroup_attach_lock(), so no task in the set can enter the exit path
> until the migration is done. Tasks which were already exiting are
> filtered out by the PF_EXITING test in cgroup_migrate_add_task().
> 
> The DEAD tests you referenced are in scx_task_iter walks which run
> without the threadgroup rwsem, where dying tasks can actually show up.
> 
> Did you try to reproduce the leak? When code review turns up a
> suspected bug, it's a good idea to reproduce it first to verify the
> assumptions before writing a fix.
> 
You're right, I missed that. 
I walked it again, a task past exit_signals() is filtered out by the PF_EXITING test in cgroup_migrate_add_task(), and a task mid-migration can't reach exit_signals() until the rwsem is dropped, so scx_cgroup_task_migrated() always sees a live task. The DEAD checks I pointed at are on task iteration paths without the rwsem, so they don't apply here.

I didn't try to reproduce the leak first. I will next time.

Please disregard this patch.Sorry for the noise.

Thanks,
Tao> Thanks.
> 
> --
> tejun