sched/ext: Prevent update_locked_rq() calls with NULL rq

JIRA: https://issues.redhat.com/browse/RHEL-111810
CVE: CVE-2025-38522

commit e14fd98
Author: Breno Leitao <leitao@debian.org>
Date:   Wed Jul 16 10:38:48 2025 -0700

    sched/ext: Prevent update_locked_rq() calls with NULL rq

    Avoid invoking update_locked_rq() when the runqueue (rq) pointer is NULL
    in the SCX_CALL_OP and SCX_CALL_OP_RET macros.

    Previously, calling update_locked_rq(NULL) with preemption enabled could
    trigger the following warning:

        BUG: using __this_cpu_write() in preemptible [00000000]

    This happens because __this_cpu_write() is unsafe to use in preemptible
    context.

    rq is NULL when an ops invoked from an unlocked context. In such cases, we
    don't need to store any rq, since the value should already be NULL
    (unlocked). Ensure that update_locked_rq() is only called when rq is
    non-NULL, preventing calling __this_cpu_write() on preemptible context.

    Suggested-by: Peter Zijlstra <peterz@infradead.org>
    Fixes: 18853ba ("sched_ext: Track currently locked rq")
    Signed-off-by: Breno Leitao <leitao@debian.org>
    Acked-by: Andrea Righi <arighi@nvidia.com>
    Signed-off-by: Tejun Heo <tj@kernel.org>
    Cc: stable@vger.kernel.org # v6.15

Signed-off-by: Phil Auld <pauld@redhat.com>

Author: auldp

kernel/sched/ext.c

@@ -1263,30 +1263,34 @@ static inline void update_locked_rq(struct rq *rq)
 
 #define SCX_CALL_OP(sch, mask, op, rq, args...)					\
 do {										\
-	update_locked_rq(rq);							\
+	if (rq)									\
+		update_locked_rq(rq);						\
 	if (mask) {								\
 		scx_kf_allow(mask);						\
 		(sch)->ops.op(args);						\
 		scx_kf_disallow(mask);						\
 	} else {								\
 		(sch)->ops.op(args);						\
 	}									\
-	update_locked_rq(NULL);							\
+	if (rq)									\
+		update_locked_rq(NULL);						\
 } while (0)
 
 #define SCX_CALL_OP_RET(sch, mask, op, rq, args...)				\
 ({										\
 	__typeof__((sch)->ops.op(args)) __ret;					\
 										\
-	update_locked_rq(rq);							\
+	if (rq)									\
+		update_locked_rq(rq);						\
 	if (mask) {								\
 		scx_kf_allow(mask);						\
 		__ret = (sch)->ops.op(args);					\
 		scx_kf_disallow(mask);						\
 	} else {								\
 		__ret = (sch)->ops.op(args);					\
 	}									\
-	update_locked_rq(NULL);							\
+	if (rq)									\
+		update_locked_rq(NULL);						\
 	__ret;									\
 })