Commit 664f0f6be37c for kernel

commit 664f0f6be37ce4ef80992cf2ed74761cd5bbe207
Merge: dca922e019dd d99f7a32f09d
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Tue Apr 28 16:26:11 2026 -0700

    Merge tag 'sched_ext-for-7.1-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext

    Pull sched_ext fixes from Tejun Heo:
     "The merge window pulled in the cgroup sub-scheduler infrastructure,
      and new AI reviews are accelerating bug reporting and fixing - hence
      the larger than usual fixes batch:

       - Use-after-frees during scheduler load/unload:
           - The disable path could free the BPF scheduler while deferred
             irq_work / kthread work was still in flight
           - cgroup setter callbacks read the active scheduler outside the
             rwsem that synchronizes against teardown
         Fix both, and reuse the disable drain in the enable error paths so
         the BPF JIT page can't be freed under live callbacks.

       - Several BPF op invocations didn't tell the framework which runqueue
         was already locked, so helper kfuncs that re-acquire the runqueue
         by CPU could deadlock on the held lock

         Fix the affected callsites, including recursive parent-into-child
         dispatch.

       - The hardlockup notifier ran from NMI but eventually took a
         non-NMI-safe lock. Bounce it through irq_work.

       - A handful of bugs in the new sub-scheduler hierarchy:
           - helper kfuncs hard-coded the root instead of resolving the
             caller's scheduler
           - the enable error path tried to disable per-task state that had
             never been initialized, and leaked cpus_read_lock on the way
             out
           - a sysfs object was leaked on every load/unload
           - the dispatch fast-path used the root scheduler instead of the
             task's
           - a couple of CONFIG #ifdef guards were misclassified

       - Verifier-time hardening: BPF programs of unrelated struct_ops types
         (e.g. tcp_congestion_ops) could call sched_ext kfuncs - a semantic
         bug and, once sub-sched was enabled, a KASAN out-of-bounds read.
         Now rejected at load. Plus a few NULL and cross-task argument
         checks on sched_ext kfuncs, and a selftest covering the new deny.

       - rhashtable (Herbert): restore the insecure_elasticity toggle and
         bounce the deferred-resize kick through irq_work to break a
         lock-order cycle observable from raw-spinlock callers. sched_ext's
         scheduler-instance hash is the first user of both.

       - The bypass-mode load balancer used file-scope cpumasks; with
         multiple scheduler instances now possible, those raced. Move to
         per-instance cpumasks, plus a follow-up to skip tasks whose
         recorded CPU is stale relative to the new owning runqueue.

       - Smaller fixes:
           - a dispatch queue's first-task tracking misbehaved when a parked
             iterator cursor sat in the list
           - the runqueue's next-class wasn't promoted on local-queue
             enqueue, leaving an SCX task behind RT in edge cases
           - the reference qmap scheduler stopped erroring on legitimate
             cross-scheduler task-storage misses"

    * tag 'sched_ext-for-7.1-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: (26 commits)
      sched_ext: Fix scx_flush_disable_work() UAF race
      sched_ext: Call wakeup_preempt() in local_dsq_post_enq()
      sched_ext: Release cpus_read_lock on scx_link_sched() failure in root enable
      sched_ext: Reject NULL-sch callers in scx_bpf_task_set_slice/dsq_vtime
      sched_ext: Refuse cross-task select_cpu_from_kfunc calls
      sched_ext: Align cgroup #ifdef guards with SUB_SCHED vs GROUP_SCHED
      sched_ext: Make bypass LB cpumasks per-scheduler
      sched_ext: Pass held rq to SCX_CALL_OP() for core_sched_before
      sched_ext: Pass held rq to SCX_CALL_OP() for dump_cpu/dump_task
      sched_ext: Save and restore scx_locked_rq across SCX_CALL_OP
      sched_ext: Use dsq->first_task instead of list_empty() in dispatch_enqueue() FIFO-tail
      sched_ext: Resolve caller's scheduler in scx_bpf_destroy_dsq() / scx_bpf_dsq_nr_queued()
      sched_ext: Read scx_root under scx_cgroup_ops_rwsem in cgroup setters
      sched_ext: Don't disable tasks in scx_sub_enable_workfn() abort path
      sched_ext: Skip tasks with stale task_rq in bypass_lb_cpu()
      sched_ext: Guard scx_dsq_move() against NULL kit->dsq after failed iter_new
      sched_ext: Unregister sub_kset on scheduler disable
      sched_ext: Defer scx_hardlockup() out of NMI
      sched_ext: sync disable_irq_work in bpf_scx_unreg()
      sched_ext: Fix local_dsq_post_enq() to use task's scheduler in sub-sched
      ...