Re: [PATCH v3 sched_ext/for-7.3 19/36] sched_ext: Add per-shard cap delegation for sub-schedulers

On Tue, 07 Jul 2026 00:39:33 +0000, [email protected] wrote:
> - [High] Missing bounds check on the shard index `si` against `target->nr_pshards` in `scx_bpf_sub_caps()` leads to an out-of-bounds array access on the `pshard` array.

The out-of-bounds access is real, but it's cross-generation rather than
a same-generation missing bounds check. A disabled scheduler still
resolvable through an fd held open by userspace keeps its pshard[] sized
to its older, smaller generation, while the shard index comes from the
current global geometry a newer root has grown - so it overruns (a read
here, a write in grant/revoke). Fixed by gating scx_prog_sched() to
return NULL for a disabled scheduler (a new prep patch), which closes it
for every sub-cap kfunc at one choke point.

Thanks.

-- 
tejun