Commit c7a1c6e8004a for kernel

commit c7a1c6e8004ab12a9c9bfdcb603f60f9bf4a3cee
Author: fangqiurong <fangqiurong@kylinos.cn>
Date:   Sat Sep 12 21:15:18 2026 +0800

    sched_ext: Close the pre-enable ops error claim window

    scx_alloc_and_add_sched() publishes ops->priv before
    scx_root_enable_workfn() switches the state to SCX_ENABLING. An error
    claimed via scx_bpf_error_bstr() from an associated BPF program in that
    window is consumed by scx_disable_workfn(), which takes the pre-enable
    shortcut in scx_root_disable(). The shortcut returns without any teardown
    and restores SCX_DISABLED with an unconditional scx_set_enable_state() xchg
    racing the enable workfn's own transition. The enable then completes with
    the claim consumed: the scheduler stays up but can never be disabled again,
    and bpf_scx_unreg() frees it while still in use, resulting in a
    use-after-free. Both WARN_ON_ONCE()s fire back to back:

      WARNING: kernel/sched/ext/ext.c:7522 at
      scx_root_enable_workfn+0xeec/0x1be0, CPU#3: scx_enable_help/276

      WARNING: kernel/sched/ext/ext.c:6398 at scx_root_disable+0xb50/0xdb8,
      CPU#0: sched_ext_helpe/664

    scx_root_enable_workfn() switches to SCX_ENABLING before the scheduler
    allocation, so ops->priv is never visible while SCX_DISABLED. The allocation
    failure path restores SCX_DISABLED.

    Fixes: 105dcd005be2 ("sched_ext: Introduce scx_prog_sched()")
    Cc: stable@vger.kernel.org
    Signed-off-by: fangqiurong <fangqiurong@kylinos.cn>
    Signed-off-by: Tejun Heo <tj@kernel.org>

diff --git a/kernel/sched/ext/ext.c b/kernel/sched/ext/ext.c
index adf5993fa597..83999203a63a 100644
--- a/kernel/sched/ext/ext.c
+++ b/kernel/sched/ext/ext.c
@@ -7516,22 +7516,24 @@ static void scx_root_enable_workfn(struct kthread_work *work)
 #ifdef CONFIG_EXT_SUB_SCHED
 	cgroup_get(cgrp);
 #endif
+	/*
+	 * Transition to ENABLING to arm the disable path. Allocation failure
+	 * still unwinds locally. Full disabling on failure applies only after
+	 * scx_alloc_and_add_sched() succeeds.
+	 */
+	WARN_ON_ONCE(scx_set_enable_state(SCX_ENABLING) != SCX_DISABLED);
+	WARN_ON_ONCE(scx_root);
+
 	sch = scx_alloc_and_add_sched(cmd, cgrp, NULL);
 	if (IS_ERR(sch)) {
 		ret = PTR_ERR(sch);
+		WARN_ON_ONCE(scx_set_enable_state(SCX_DISABLED) != SCX_ENABLING);
 		goto err_free_tid_hash;
 	}

 	if (sch->is_cid_type)
 		static_branch_enable(&__scx_is_cid_type);

-	/*
-	 * Transition to ENABLING and clear exit info to arm the disable path.
-	 * Failure triggers full disabling from here on.
-	 */
-	WARN_ON_ONCE(scx_set_enable_state(SCX_ENABLING) != SCX_DISABLED);
-	WARN_ON_ONCE(scx_root);
-
 	atomic_long_set(&scx_nr_rejected, 0);

 	for_each_possible_cpu(cpu) {