sched_ext: Pin parent scx_sched across a child sub-scheduler's lifetime

A child sub-scheduler dereferences its parent scx_sched throughout its life,
e.g., in scx_sub_disable() which reparents the child's tasks and calls
parent->ops.sub_detach() after unlinking from the parent. However, the
parent is pinned only through parent->sub_kset, which is dropped during
disable. The parent scx_sched can be RCU-freed while a child is still
disabling.

Take a direct reference on the parent in scx_alloc_and_add_sched(), dropped
in scx_sched_free_rcu_work(), so a parent always outlives its descendants.

Signed-off-by: Tejun Heo <tj@kernel.org>
This commit is contained in:
Tejun Heo
2026-06-25 13:23:56 -10:00
parent 115d1ce989
commit cb36d81e75

View File

@@ -4916,6 +4916,8 @@ static void scx_sched_free_rcu_work(struct work_struct *work)
cgroup_put(sch_cgroup(sch));
if (sch->sub_kset)
kobject_put(&sch->sub_kset->kobj);
if (scx_parent(sch))
kobject_put(&scx_parent(sch)->kobj);
#endif /* CONFIG_EXT_SUB_SCHED */
for_each_possible_cpu(cpu) {
@@ -6863,12 +6865,19 @@ static struct scx_sched *scx_alloc_and_add_sched(struct scx_enable_cmd *cmd,
INIT_LIST_HEAD(&sch->children);
INIT_LIST_HEAD(&sch->sibling);
if (parent)
if (parent) {
/*
* Pin @parent for @sch's lifetime. The kobject hierarchy pins
* it only via @parent->sub_kset, which is dropped during
* disable. Released in scx_sched_free_rcu_work().
*/
kobject_get(&parent->kobj);
ret = kobject_init_and_add(&sch->kobj, &scx_ktype,
&parent->sub_kset->kobj,
"sub-%llu", cgroup_id(cgrp));
else
} else {
ret = kobject_init_and_add(&sch->kobj, &scx_ktype, NULL, "root");
}
if (ret < 0) {
RCU_INIT_POINTER(ops->priv, NULL);