Re: [PATCH v3 sched_ext/for-7.3 09/36] sched_ext: Make the kick machinery per-sched
Tejun Heo <[email protected]>
| Newsgroups | dev.linux.lists.sched-ext,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <[email protected]> |
On Tue, 07 Jul 2026 00:33:33 +0000, [email protected] wrote: > - [High] Early return in `kick_cpus_irq_workfn()` skips removing `pcpu->to_kick_node` from `sched_pcpus_to_kick` if `ksyncs_pcpu` is NULL, leading to a Use-After-Free when the `pcpu` structure is later freed. The UAF isn't reachable: disable turns on bypass and does a synchronize_rcu() before free_kick_syncs(), which fires any pending kick irq_work first, so the workfn unlinks its to_kick_node while ksyncs is still published. I've added an explicit irq_work_sync() in the free path anyway so the invariant is local rather than resting on the disable-path ordering. Thanks. -- tejun