CVE-2025-21897

sched_ext: Fix pick_task_scx() picking non-queued tasks when it's called without balance()

published April 1, 2025

CVSS
—
EPSS
0%
Percentile
3.9
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

sched_ext: Fix pick_task_scx() picking non-queued tasks when it's called without balance()

a6250aa251ea ("sched_ext: Handle cases where pick_task_scx() is called

without preceding balance_scx()") added a workaround to handle the cases

where pick_task_scx() is called without prececing balance_scx() which is due

to a fair class bug where pick_taks_fair() may return NULL after a true

return from balance_fair().

The workaround detects when pick_task_scx() is called without preceding

balance_scx() and emulates SCX_RQ_BAL_KEEP and triggers kicking to avoid

stalling. Unfortunately, the workaround code was testing whether @prev was

on SCX to decide whether to keep the task running. This is incorrect as the

task may be on SCX but no longer runnable.

This could lead to a non-runnable task to be returned from pick_task_scx()

which cause interesting confusions and failures. e.g. A common failure mode

is the task ending up with (!on_rq && on_cpu) state which can cause

potential wakers to busy loop, which can easily lead to deadlocks.

Fix it by testing whether @prev has SCX_TASK_QUEUED set. This makes

@prev_on_scx only used in one place. Open code the usage and improve the

comment while at it.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00151 · 3.9th percentile
Published
2025-04-01T15:26Z
EPSS history
Timeline
  • 01 APR 15:26Z
    sched_ext: Fix pick_task_scx() picking non-queued tasks when it's called without balance()
    cvelistv5