From nobody Mon Jun 15 07:36:26 2026 Received: from m16.mail.126.com (m16.mail.126.com [117.135.210.7]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0024A27707 for ; Thu, 9 Apr 2026 03:22:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=117.135.210.7 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775704949; cv=none; b=CZMb+0LVbAqqBUV+1x0TDsDdhW7fzQdHE6C7lahxVvioxWs0dGh2f703v8LoSrs+wcqXAjfG/X/yXGBD1sXeWAVMvXOXJAHNhSwjkZnn+MrxS18rGQQiGnNlGW9WnHr5eECFPoUIusqMKOESf+6BotG+IkNcvzXu81gHv4JeHfA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775704949; c=relaxed/simple; bh=myoYvxEpHaK02ZUpbjNq5jqrcbUXWOp79xzxmXAF2WY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Bu/PVCSEtwkqiVxJq6ZE5pfnKveHeLiRJsFBoqwr2325m1QPC0iaEgV5FOdBaYITjw57Afwm6fBMr+oShsSVAUSZ+noBBVYsCFZ1gqKjgMmI5EK5IQuUkm+YbAtxb4tTYMhuA4iwopQlnAd9kiN7nbIxoFac6GO++kXkPYV63bA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=126.com; spf=pass smtp.mailfrom=126.com; dkim=pass (1024-bit key) header.d=126.com header.i=@126.com header.b=DdQlIRSc; arc=none smtp.client-ip=117.135.210.7 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=126.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=126.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=126.com header.i=@126.com header.b="DdQlIRSc" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=126.com; s=s110527; h=From:To:Subject:Date:Message-ID:MIME-Version; bh=dT ao++VDJ96s8B+9W0qSmQbSrnA858ROCq3VoD5PONs=; b=DdQlIRScHNv3pCIhAL +b5i8/oy2qmZc3dqqjR543MeAMdcN/EHgcwM0LwNqSxAzEP008dv2y4tev0bDaWS NwHCFCrWSXKZi7bp9gLvh/rxBljMo5+vTXyozHhhDZ6BzjaW1OjqnVfE+MNfcFWo gfOXpWOZwn2nVFPivnKmdb6dA= Received: from localhost.localdomain (unknown []) by gzga-smtp-mtada-g1-2 (Coremail) with SMTP id _____wDndx5AG9dpKePoBA--.19355S3; Thu, 09 Apr 2026 11:21:37 +0800 (CST) From: Zhao Mengmeng To: tj@kernel.org, void@manifault.com, arighi@nvidia.com, changwoo@igalia.com Cc: sched-ext@lists.linux.dev, linux-kernel@vger.kernel.org, zhaomengmeng@kylinos.cn Subject: [PATCH 1/3] sched_ext: Prevent CPU kicks from exiting schedulers Date: Thu, 9 Apr 2026 11:21:24 +0800 Message-ID: <20260409032126.114812-2-zhaomzhao@126.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260409032126.114812-1-zhaomzhao@126.com> References: <20260409032126.114812-1-zhaomzhao@126.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: _____wDndx5AG9dpKePoBA--.19355S3 X-Coremail-Antispam: 1Uf129KBjvJXoWxZFyxKFWxGr1UCF15tFW3GFg_yoW5Kw1fpF W3tFW8Cr4xWrWjqw1UAw4vq345GFZrAa4xJr4DKFnrAF45CF1kXr1xta17Xr1jkr45C342 qF1DK395Kr1jq3DanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDUYxBIdaVFxhVjvjDU0xZFpf9x07jjHq7UUUUU= X-CM-SenderInfo: 52kd0zp2kd0qqrswhudrp/xtbBlwEnnmnXG0GBHAAA3W Content-Type: text/plain; charset="utf-8" From: Zhao Mengmeng On PC with 8 core, when running scx_central with stress-ng -c 2 --io 8, if enable/disable scx_central frequently, dmesg will pop an message: [ 38.214510] sched_ext: BPF scheduler "central" enabled [ 47.809167] hrtimer: interrupt took 11287895 ns [ 48.233813] sched_ext: BPF scheduler "central" disabled (unregistere= d from user space) [ 48.248460] kick_cpus_irq_workfn() called with NULL scx_kick_syncs <= ---- here [ 54.597735] sched_ext: BPF scheduler "central" enabled After adding dump stack in the warning code, it shows: [ 231.269159] sched_ext: BPF scheduler "central" disabled (unregistered fr= om user space) [ 231.278500] CPU: 0 UID: 0 PID: 123 Comm: tmux: server Not tainted 7.0.0-= rc2-virtme #13 PREEMPT(full) [ 231.278519] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 231.278536] Call Trace: [ 231.278556] [ 231.278571] dump_stack_lvl+0x6f/0xb0 [ 231.278640] kick_cpus_irq_workfn.cold+0x19/0x57 [ 231.278670] ? mark_held_locks+0x40/0x70 [ 231.278691] ? _raw_spin_unlock_irqrestore+0x4b/0x70 [ 231.278716] ? __pfx_kick_cpus_irq_workfn+0x10/0x10 [ 231.278750] irq_work_single+0xcd/0x250 [ 231.278776] irq_work_run_list+0x6a/0xa0 [ 231.278794] irq_work_run+0x18/0x30 [ 231.278805] __sysvec_irq_work+0x4f/0x320 [ 231.278842] sysvec_irq_work+0x43/0xb0 [ 231.278863] asm_sysvec_irq_work+0x1a/0x20 [ 231.278883] RIP: 0010:scx_kick_cpu.part.0+0x25b/0x680 [ 231.278897] Code: 00 02 75 31 48 89 df e8 03 34 fd ff 4d 85 ed 0f 84 3c = ff [ 231.278906] RSP: 0018:ffff888035e08cb8 EFLAGS: 00000286 [ 231.278934] RAX: 0000000000000082 RBX: 0000000000000000 RCX: ffffffff88c= ec5cb [ 231.278946] RDX: ffff888002821d40 RSI: 0000000000000000 RDI: ffffffff88c= ec5cb [ 231.278956] RBP: ffff888035e49d00 R08: 0000000000000000 R09: 00000000000= 00001 [ 231.278961] R10: ffff8880028228a0 R11: ffff888002821d40 R12: 00000000000= 00004 [ 231.278967] R13: 0000000000000200 R14: 0000000000000002 R15: 00000004000= 00000 [ 231.278998] ? scx_kick_cpu.part.0+0x24b/0x680 [ 231.279015] ? scx_kick_cpu.part.0+0x24b/0x680 [ 231.279039] ? ops_cpu_valid+0x6c/0xf0 [ 231.279060] scx_bpf_kick_cpu+0xba/0x2e0 [ 231.279086] bpf_prog_402c05d73c49876a_central_timerfn+0x24f/0x26c [ 231.279117] ? 0xffffffffc0409050 [ 231.279150] ? rcu_read_lock_bh_held+0x2b/0x60 [ 231.279181] bpf_timer_cb+0x168/0x2b0 [ 231.279201] ? __pfx_bpf_timer_cb+0x10/0x10 The whole process is: in scx_root_disable(), after setting scx_kick_syncs to NULL in free_kick_syncs(), it then exits bypass mode. Since the BPF timer is stored in BPF map, which is only destroyed at BPF program exiting, it now can still fire and call scx_bpf_kick_cpu(). It will pass the scx_bypassing() check and queue irq work, as a result, the null check in kick_cpus_irq_workfn() is hitted. In kernel side, fix it by checking sch->aborting in scx_kick_cpu, prevent new kicks if the scheduler is in aborting state. Signed-off-by: Zhao Mengmeng --- kernel/sched/ext.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/kernel/sched/ext.c b/kernel/sched/ext.c index b757b853b42b..0a2a3c6dc7cc 100644 --- a/kernel/sched/ext.c +++ b/kernel/sched/ext.c @@ -8679,6 +8679,9 @@ static void scx_kick_cpu(struct scx_sched *sch, s32 c= pu, u64 flags) if (!ops_cpu_valid(sch, cpu, NULL)) return; =20 + if (unlikely(READ_ONCE(sch->aborting))) + return; + local_irq_save(irq_flags); =20 this_rq =3D this_rq(); --=20 2.43.0 From nobody Mon Jun 15 07:36:26 2026 Received: from m16.mail.126.com (m16.mail.126.com [220.197.31.9]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5D387340A57 for ; Thu, 9 Apr 2026 03:24:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=220.197.31.9 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775705045; cv=none; b=UjvUE/62sYSKu1e1eJw3F0iJnuffYEzjbaV6OfGW1M6ikJA5ZE/ZFjmQ10o7Xdsc+ltJzPSg8Wx2JvbyX+9eBr0jkpGrcZP+sADb379L4egE43Xcc4lqTdJNV9vFLOix//gk2PVANlAr8dW8/nxg80HAOA6c/IET6E51J3Qellc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775705045; c=relaxed/simple; bh=QalazcFu8iOREwryftfpJMzcVqtrXDg81FW/qQokQ00=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Em5etXxnQKIvTCfhMiAXdRLTvvbypiuPzkTMHBsZJTNbMPw1XQDO8Nie6LYLznhgarhP71tDKhAC47W6+MLa/tQOWCOE65F8UWsWyn1kyA2bEhS9vHkR2AKU8gks8GY9rUF8rpS4e8NN57Qme4KV//7EFNOPuGBgj5L4zWGEsxI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=126.com; spf=pass smtp.mailfrom=126.com; dkim=pass (1024-bit key) header.d=126.com header.i=@126.com header.b=LJtwpSlG; arc=none smtp.client-ip=220.197.31.9 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=126.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=126.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=126.com header.i=@126.com header.b="LJtwpSlG" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=126.com; s=s110527; h=From:To:Subject:Date:Message-ID:MIME-Version; bh=Ee TIvJCaqvOOkXamuiiRvwQSyuH2rNzgLdbkztr803A=; b=LJtwpSlG2HYsIgXOXL VZf/u5vIAyReBpwG/ehu1X35yp8/ChgGxLSpBkg549pY4RaJVqYhE2nRFbMtkGfj +HiGUnMje8zXz/JCUBNf5dOWDkpN0edVOa+9f+OaiHnebURp7OXxkeZg4dLCsiYe Miv8b6wYs0nYMFmrL563yAG+8= Received: from localhost.localdomain (unknown []) by gzga-smtp-mtada-g1-2 (Coremail) with SMTP id _____wDndx5AG9dpKePoBA--.19355S4; Thu, 09 Apr 2026 11:21:37 +0800 (CST) From: Zhao Mengmeng To: tj@kernel.org, void@manifault.com, arighi@nvidia.com, changwoo@igalia.com Cc: sched-ext@lists.linux.dev, linux-kernel@vger.kernel.org, zhaomengmeng@kylinos.cn Subject: [PATCH 2/3] scx_central: Cancel BPF timer during ops.exit Date: Thu, 9 Apr 2026 11:21:25 +0800 Message-ID: <20260409032126.114812-3-zhaomzhao@126.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260409032126.114812-1-zhaomzhao@126.com> References: <20260409032126.114812-1-zhaomzhao@126.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: _____wDndx5AG9dpKePoBA--.19355S4 X-Coremail-Antispam: 1Uf129KBjvdXoWrKr4Uur13GFyrXr45WFyfWFg_yoWfuwc_C3 W3Wr18AFs8GF1ak3WYkr4UXF1FkFZ5KFs8WrWIg393ZF4UJFn8AF1UCF4DuryDKw4UZFsr CFs7XF48Zr929jkaLaAFLSUrUUUUjb8apTn2vfkv8UJUUUU8Yxn0WfASr-VFAUDa7-sFnT 9fnUUvcSsGvfC2KfnxnUUI43ZEXa7IU81KZJUUUUU== X-CM-SenderInfo: 52kd0zp2kd0qqrswhudrp/xtbBlgEnnmnXG0FMlQAA3T Content-Type: text/plain; charset="utf-8" From: Zhao Mengmeng Cancel the BPF timer in ops.exit, which is called before free_kick_syncs(), so that new cpu kick will not come and hit the NULL check in kick_cpus_irq_workfn(). Signed-off-by: Zhao Mengmeng --- tools/sched_ext/scx_central.bpf.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/tools/sched_ext/scx_central.bpf.c b/tools/sched_ext/scx_centra= l.bpf.c index 4efcce099bd5..6c2cd5511a25 100644 --- a/tools/sched_ext/scx_central.bpf.c +++ b/tools/sched_ext/scx_central.bpf.c @@ -359,7 +359,14 @@ int BPF_STRUCT_OPS_SLEEPABLE(central_init) =20 void BPF_STRUCT_OPS(central_exit, struct scx_exit_info *ei) { + u32 key =3D 0; + struct bpf_timer *timer; + UEI_RECORD(uei, ei); + + timer =3D bpf_map_lookup_elem(¢ral_timer, &key); + if (timer) + bpf_timer_cancel(timer); } =20 SCX_OPS_DEFINE(central_ops, --=20 2.43.0 From nobody Mon Jun 15 07:36:26 2026 Received: from m16.mail.126.com (m16.mail.126.com [220.197.31.9]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6D68A27707 for ; Thu, 9 Apr 2026 03:24:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=220.197.31.9 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775705044; cv=none; b=rK9r4TpZ453YOcXWl3faNi52qNNmGmvfqXnw4awwNkV/YPChJeKWHl8B2TRk0Q7y9bReUKRpjCzfHvg4OLhwK7RQBVAOc5+r+kDwXKkDMRdA4CzJcMUpJLG7nK+QHcFQLixtFPp53246ehoCxBcFATVp6m4QD21JGDkHz/Ab+NM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775705044; c=relaxed/simple; bh=kuhVHGIMMxlVAZEMFcXBCd95aTOiyrWQXaN265GIct8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=n/UyXZwGJC9W2On3k8ZZtcI1acicQljridZJSdu1302raBIKjC3zWx8LhJLruWqnhdetAiBDetETjOFqEcEcHHws2Y/8R/0zNuo9Okl2Gv/suDJO7eTu3x67sbfBTBnZB8+zDMlTOQWR3zpx6uACyToOBIBcqoiRhrbvYT35q2Y= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=126.com; spf=pass smtp.mailfrom=126.com; dkim=pass (1024-bit key) header.d=126.com header.i=@126.com header.b=LqWdwLuH; arc=none smtp.client-ip=220.197.31.9 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=126.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=126.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=126.com header.i=@126.com header.b="LqWdwLuH" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=126.com; s=s110527; h=From:To:Subject:Date:Message-ID:MIME-Version; bh=Ah mnJ7Z1PPwxAS80TCrKZMd7o1hyLxkkpEVlDV+ui8g=; b=LqWdwLuHwKHh0/fhCN iOqjeDLMKKa4eDxT4CrLhUKgXutH1ehay0h6CyPBDRagYORPtjNWSrIlGDwlaifh 7c7vflqVQTq3fBI4sy9OR9SHk1VsdcKWljVgcIvE2x5frOW5qwgd3zu47UFfaOgO qR7IscFACsxIiH+f5/uAqCQa4= Received: from localhost.localdomain (unknown []) by gzga-smtp-mtada-g1-2 (Coremail) with SMTP id _____wDndx5AG9dpKePoBA--.19355S5; Thu, 09 Apr 2026 11:21:38 +0800 (CST) From: Zhao Mengmeng To: tj@kernel.org, void@manifault.com, arighi@nvidia.com, changwoo@igalia.com Cc: sched-ext@lists.linux.dev, linux-kernel@vger.kernel.org, zhaomengmeng@kylinos.cn Subject: [PATCH 3/3] sched_ext: Use WARN_ON_ONCE to check whether scx_kick_syncs is NULL Date: Thu, 9 Apr 2026 11:21:26 +0800 Message-ID: <20260409032126.114812-4-zhaomzhao@126.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260409032126.114812-1-zhaomzhao@126.com> References: <20260409032126.114812-1-zhaomzhao@126.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: _____wDndx5AG9dpKePoBA--.19355S5 X-Coremail-Antispam: 1Uf129KBjvdXoWrKw4fGry7Aw48KFWxXFW5KFg_yoWfJFb_u3 srAwnFk3yrKFn0v3W3Ga1IqrWfKFykJ3Z5CrySga97ArZ5WrWvqas8AFZ8Jrn3Wa1UCr98 AFsIqFZrtFnagjkaLaAFLSUrUUUUjb8apTn2vfkv8UJUUUU8Yxn0WfASr-VFAUDa7-sFnT 9fnUUvcSsGvfC2KfnxnUUI43ZEXa7IU8KYL3UUUUU== X-CM-SenderInfo: 52kd0zp2kd0qqrswhudrp/xtbBqgInnmnXG0JErAAA3e Content-Type: text/plain; charset="utf-8" From: Zhao Mengmeng Since we already add checks in scx_kick_cpu() to prevent the race, replace pr_warn_once with WARN_ON_ONCE to capture future race conditions. Signed-off-by: Zhao Mengmeng --- kernel/sched/ext.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/kernel/sched/ext.c b/kernel/sched/ext.c index 0a2a3c6dc7cc..cc03924842e1 100644 --- a/kernel/sched/ext.c +++ b/kernel/sched/ext.c @@ -7702,10 +7702,8 @@ static void kick_cpus_irq_workfn(struct irq_work *ir= q_work) unsigned long *ksyncs; s32 cpu; =20 - if (unlikely(!ksyncs_pcpu)) { - pr_warn_once("kick_cpus_irq_workfn() called with NULL scx_kick_syncs"); + if (WARN_ON_ONCE(!ksyncs_pcpu)) return; - } =20 ksyncs =3D rcu_dereference_bh(ksyncs_pcpu)->syncs; =20 --=20 2.43.0