From: Tao Cui <cuitao@kylinos.cn>

scx_bpf_dsq_reenq() queues a deferred reenq (dru) that runs from
run_deferred(), not ops.dispatch(). If the DSQ is destroyed before the dru
runs, process_deferred_reenq_users() sees dsq->id == SCX_DSQ_INVALID and
hits the BUG_ON. destroy_dsq() doesn't flush pending drus, so just skip.

Fixes: 84b1a0ea0b7c ("sched_ext: Implement scx_bpf_dsq_reenq() for user DSQs")

Signed-off-by: Tao Cui <cuitao@kylinos.cn>
---
 kernel/sched/ext/ext.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/kernel/sched/ext/ext.c b/kernel/sched/ext/ext.c
index 0bbe144c9811..604a05da41b9 100644
--- a/kernel/sched/ext/ext.c
+++ b/kernel/sched/ext/ext.c
@@ -4531,7 +4531,9 @@ static void process_deferred_reenq_users(struct rq *rq)
 		/* see schedule_dsq_reenq() */
 		smp_mb();
 
-		BUG_ON(dsq->id & SCX_DSQ_FLAG_BUILTIN);
+		/* destroy_dsq() may race and invalidate @dsq; skip */
+		if (unlikely(dsq->id & SCX_DSQ_FLAG_BUILTIN))
+			continue;
 		reenq_user(rq, dsq, reenq_flags);
 	}
 }
-- 
2.43.0

Hello,

On Tue, Aug 11, 2026 at 03:59:12PM +0800, Tao Cui wrote:
> -		BUG_ON(dsq->id & SCX_DSQ_FLAG_BUILTIN);
> +		/* destroy_dsq() may race and invalidate @dsq; skip */
> +		if (unlikely(dsq->id & SCX_DSQ_FLAG_BUILTIN))
> +			continue;

Nice catch, but this also swallows states which can never occur
legitimately. The only builtin-flagged value that can show up here is
SCX_DSQ_INVALID from destroy_dsq(). Let's keep the BUG_ON for everything
else:

	/* destroy_dsq() may have raced and invalidated @dsq, nothing to reenq */
	if (unlikely(dsq->id == SCX_DSQ_INVALID))
		continue;

	BUG_ON(dsq->id & SCX_DSQ_FLAG_BUILTIN);

Can you please spin v2? Also, please capitalize the subject after the
prefix ("Don't ...") and remove the blank line between the tags.

Thanks.

--
tejun

在 2026/8/15 02:56, Tejun Heo 写道:
> Hello,
> 
> On Tue, Aug 11, 2026 at 03:59:12PM +0800, Tao Cui wrote:
>> -		BUG_ON(dsq->id & SCX_DSQ_FLAG_BUILTIN);
>> +		/* destroy_dsq() may race and invalidate @dsq; skip */
>> +		if (unlikely(dsq->id & SCX_DSQ_FLAG_BUILTIN))
>> +			continue;
> 
> Nice catch, but this also swallows states which can never occur
> legitimately. The only builtin-flagged value that can show up here is
> SCX_DSQ_INVALID from destroy_dsq(). Let's keep the BUG_ON for everything
> else:
> 
> 	/* destroy_dsq() may have raced and invalidated @dsq, nothing to reenq */
> 	if (unlikely(dsq->id == SCX_DSQ_INVALID))
> 		continue;
> 
> 	BUG_ON(dsq->id & SCX_DSQ_FLAG_BUILTIN);
> 
> Can you please spin v2? Also, please capitalize the subject after the
> prefix ("Don't ...") and remove the blank line between the tags.
> 
Right, that was too broad. v2 skips only SCX_DSQ_INVALID and keeps the BUG_ON otherwise, as you suggested. Also fixed the subject capitalization and the blank line between the tags.

Thanks,
Tao

> Thanks.
> 
> --
> tejun