Re: [PATCH v4 sched_ext/for-7.3 23/40] sched_ext: Maintain per-cpu effective cap copies for single-read checks

On Wed, 08 Jul 2026 22:03:27 +0000, [email protected] wrote:
> - [High] Unconditional evaluation of `__scx_cpu_to_cid(cpu_of(rq))` and
> `scx_cid_to_shard[cid]` in `scx_process_sync_ecaps()` causes a kernel
> crash (NULL pointer dereference) during initialization failures.

The llist_empty() check is the first statement in the function - the cid
and shard evaluations sit behind it, and the teardown/discard path
doesn't call scx_process_sync_ecaps() at all. Same as the earlier
rounds:

  https://lore.kernel.org/r/[email protected]

> - [High] Naked and unchecked use of the global `scx_root` pointer in
> `queue_sync_ecaps()` causes a NULL pointer dereference if the root
> scheduler is concurrently disabled.

The sub-cap kfuncs run under a function-wide guard(irqsave), which is an
RCU read section. Root disable runs drain_descendants() and then sets
dead + synchronize_rcu() before clearing scx_root, so an in-flight kfunc
can't observe the NULL and a later one bails at scx_prog_sched(). Passing
@sch instead would be wrong the other way - the kick drives the
root-owned balance_one() and wants root's bypass state.

Thanks.

-- 
tejun