Commit 1336b579f607 for kernel

commit 1336b579f6079fb8520be03624fcd9ba443c930b
Author: Cheng-Yang Chou <yphbchou0911@gmail.com>
Date:   Tue Mar 3 22:35:30 2026 +0800

    sched_ext: Remove redundant css_put() in scx_cgroup_init()

    The iterator css_for_each_descendant_pre() walks the cgroup hierarchy
    under cgroup_lock(). It does not increment the reference counts on
    yielded css structs.

    According to the cgroup documentation, css_put() should only be used
    to release a reference obtained via css_get() or css_tryget_online().
    Since the iterator does not use either of these to acquire a reference,
    calling css_put() in the error path of scx_cgroup_init() causes a
    refcount underflow.

    Remove the unbalanced css_put() to prevent a potential Use-After-Free
    (UAF) vulnerability.

    Fixes: 819513666966 ("sched_ext: Add cgroup support")
    Cc: stable@vger.kernel.org # v6.12+
    Signed-off-by: Cheng-Yang Chou <yphbchou0911@gmail.com>
    Reviewed-by: Andrea Righi <arighi@nvidia.com>
    Signed-off-by: Tejun Heo <tj@kernel.org>

diff --git a/kernel/sched/ext.c b/kernel/sched/ext.c
index 2ba69b302368..eab6e09b6442 100644
--- a/kernel/sched/ext.c
+++ b/kernel/sched/ext.c
@@ -3589,7 +3589,6 @@ static int scx_cgroup_init(struct scx_sched *sch)
 		ret = SCX_CALL_OP_RET(sch, SCX_KF_UNLOCKED, cgroup_init, NULL,
 				      css->cgroup, &args);
 		if (ret) {
-			css_put(css);
 			scx_error(sch, "ops.cgroup_init() failed (%d)", ret);
 			return ret;
 		}