[PATCH 18/17] sched_ext: Fix use-after-free of a NONE rescuee leaving sched_ext

[Tejun Heo]

An earlier patch, "sched_ext: Fix bypassed tasks stalling when the host
lacks SCX_CAP_BASE", sends a bypassed task to rescue when its host lacks
BASE on the cpu. That reaches a task scx_fail_parent() punted to its
bypassing parent at NONE, so such a task can be a rescuee.

switched_from_scx() returned early for a NONE task and skipped the slice end
scx_disable_task() does for the other states. A NONE rescuee leaving
sched_ext while running, through a setscheduler or a priority boost with
slice left, left rq->scx.rescue.curr pointing at it, a use-after-free once
the task exits.

End the slice for a NONE task there, which ends the rescue with it.

Reported-by: Sashiko <sashiko-bot@xxxxxxxxxx>
Signed-off-by: Tejun Heo <tj@xxxxxxxxxx>
---
 kernel/sched/ext/ext.c | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/kernel/sched/ext/ext.c b/kernel/sched/ext/ext.c
index a274210007fa..8241cf374ef9 100644
--- a/kernel/sched/ext/ext.c
+++ b/kernel/sched/ext/ext.c
@@ -4960,16 +4960,15 @@ static void switched_from_scx(struct rq *rq, struct task_struct *p)
 		return;
 
 	/*
-	 * %NONE means SCX is no longer tracking @p at the task level (e.g.
-	 * scx_fail_parent() handed @p back to the parent at NONE pending the
-	 * parent's own teardown). There is nothing to disable; calling
-	 * scx_disable_task() would WARN on the non-%ENABLED state and trigger a
-	 * NONE -> READY validation failure.
+	 * A %NONE task, one scx_fail_parent() punted to its bypassing parent,
+	 * has nothing to disable and scx_disable_task() would WARN on it. It
+	 * can still be a rescuee under the parent, so end its slice here as
+	 * scx_disable_task() does for the other states.
 	 */
 	if (scx_get_task_state(p) == SCX_TASK_NONE)
-		return;
-
-	scx_disable_task(scx_task_sched(p), p);
+		scx_task_slice_ended(rq, p);
+	else
+		scx_disable_task(scx_task_sched(p), p);
 }
 
 static void switched_to_scx(struct rq *rq, struct task_struct *p) {}
-- 
2.56.0