Skip to content
This repository has been archived by the owner on Jun 18, 2024. It is now read-only.

scx: Invoke ops.exit_task() for TASK_DEAD tasks on disable path #211

Merged
merged 1 commit into from
May 22, 2024

Conversation

Byte-Lab
Copy link
Collaborator

In commit f266831 ("scx: Close a small race window in the enable path which can lead to use-after-free"), we fixed a race window on the enable path that could cause a crash. This fix is fine, but was a bit too aggressive in that it could also cause us to miss ops.exit_task() invocations in the following scenario:

  1. A task exits and invokes do_task_dead() (making its state TASK_DEAD), but someone still holds a refcount on it somewhere.

  2. The scheduler is disabled.

  3. On the disable path, we don't invoke ops.task_exit()

  4. We don't invoke it in sched_ext_free() either later, because by then the scheduler has been disabled.

Let's ensure we don't skip on exiting the task by still calling scx_ops_exit_task() for TASK_DEAD tasks on the disable path.

@Byte-Lab Byte-Lab requested a review from htejun May 22, 2024 19:05
kernel/sched/ext.c Outdated Show resolved Hide resolved
kernel/sched/ext.c Outdated Show resolved Hide resolved
kernel/sched/ext.c Outdated Show resolved Hide resolved
@Byte-Lab Byte-Lab force-pushed the disable_fix branch 4 times, most recently from 8ab48f9 to cf262cc Compare May 22, 2024 19:46
In commit f266831 ("scx: Close a small race window in the enable path
which can lead to use-after-free"), we fixed a race window on the enable path
that could cause a crash. This fix is fine, but was a bit too aggressive in
that it could also cause us to miss ops.exit_task() invocations in the
following scenario:

1. A task exits and invokes do_task_dead() (making its state TASK_DEAD), but
   someone still holds a refcount on it somewhere.

2. The scheduler is disabled.

3. On the disable path, we don't invoke ops.task_exit()

4. We don't invoke it in sched_ext_free() either later, because by then the
   scheduler has been disabled.

Let's ensure we don't skip on exiting the task by still calling
scx_ops_exit_task() for TASK_DEAD tasks on the disable path.

Signed-off-by: David Vernet <[email protected]>
@Byte-Lab
Copy link
Collaborator Author

Sorry for so many force pushes, forgot to invert the polarity of the include_dead flag in the callers + check. It should be good to go now.

@Byte-Lab Byte-Lab merged commit 6f386ca into sched_ext May 22, 2024
1 check passed
@Byte-Lab Byte-Lab deleted the disable_fix branch May 22, 2024 20:00
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants