a6250aa251ea ("sched_ext: Handle cases where pick_task_scx() is called
without preceding balance_scx()") added a workaround to handle the cases
where pick_task_scx() is called without prececing balance_scx() which is due
to a fair class bug where pick_taks_fair() may return NULL after a true
return from balance_fair().

The workaround detects when pick_task_scx() is called without preceding
balance_scx() and emulates SCX_RQ_BAL_KEEP and triggers kicking to avoid
stalling. Unfortunately, the workaround code was testing whether @prev was
on SCX to decide whether to keep the task running. This is incorrect as the
task may be on SCX but no longer runnable.

This could lead to a non-runnable task to be returned from pick_task_scx()
which cause interesting confusions and failures. e.g. A common failure mode
is the task ending up with (!on_rq && on_cpu) state which can cause
potential wakers to busy loop, which can easily lead to deadlocks.

Fix it by testing whether @prev has SCX_TASK_QUEUED set. This makes
$prev_on_scx only used in one place. Open code the usage and improve the
comment while at it.

Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-by: Pat Cody <patcody@meta.com>
Fixes: a6250aa251ea ("sched_ext: Handle cases where pick_task_scx() is called without preceding balance_scx()")
Cc: stable@vger.kernel.org # v6.12+
---
 kernel/sched/ext.c |   11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/kernel/sched/ext.c b/kernel/sched/ext.c
index 5a81d9a1e31f..0f1da199cfc7 100644
--- a/kernel/sched/ext.c
+++ b/kernel/sched/ext.c
@@ -3117,7 +3117,6 @@ static struct task_struct *pick_task_scx(struct rq *rq)
 {
 	struct task_struct *prev = rq->curr;
 	struct task_struct *p;
-	bool prev_on_scx = prev->sched_class == &ext_sched_class;
 	bool keep_prev = rq->scx.flags & SCX_RQ_BAL_KEEP;
 	bool kick_idle = false;
 
@@ -3137,14 +3136,18 @@ static struct task_struct *pick_task_scx(struct rq *rq)
 	 * if pick_task_scx() is called without preceding balance_scx().
 	 */
 	if (unlikely(rq->scx.flags & SCX_RQ_BAL_PENDING)) {
-		if (prev_on_scx) {
+		if (prev->scx.flags & SCX_TASK_QUEUED) {
 			keep_prev = true;
 		} else {
 			keep_prev = false;
 			kick_idle = true;
 		}
-	} else if (unlikely(keep_prev && !prev_on_scx)) {
-		/* only allowed during transitions */
+	} else if (unlikely(keep_prev &&
+			    prev->sched_class != &ext_sched_class)) {
+		/*
+		 * Can happen while enabling as SCX_RQ_BAL_PENDING assertion is
+		 * conditional on scx_enabled() and may have been skipped.
+		 */
 		WARN_ON_ONCE(scx_ops_enable_state() == SCX_OPS_ENABLED);
 		keep_prev = false;
 	}

On Tue, Feb 25, 2025 at 06:02:23AM -1000, Tejun Heo wrote:
> a6250aa251ea ("sched_ext: Handle cases where pick_task_scx() is called
> without preceding balance_scx()") added a workaround to handle the cases
> where pick_task_scx() is called without prececing balance_scx() which is due
> to a fair class bug where pick_taks_fair() may return NULL after a true
> return from balance_fair().
> 
> The workaround detects when pick_task_scx() is called without preceding
> balance_scx() and emulates SCX_RQ_BAL_KEEP and triggers kicking to avoid
> stalling. Unfortunately, the workaround code was testing whether @prev was
> on SCX to decide whether to keep the task running. This is incorrect as the
> task may be on SCX but no longer runnable.
> 
> This could lead to a non-runnable task to be returned from pick_task_scx()
> which cause interesting confusions and failures. e.g. A common failure mode
> is the task ending up with (!on_rq && on_cpu) state which can cause
> potential wakers to busy loop, which can easily lead to deadlocks.
> 
> Fix it by testing whether @prev has SCX_TASK_QUEUED set. This makes
> $prev_on_scx only used in one place. Open code the usage and improve the
> comment while at it.
> 
> Signed-off-by: Tejun Heo <tj@kernel.org>
> Reported-by: Pat Cody <patcody@meta.com>
> Fixes: a6250aa251ea ("sched_ext: Handle cases where pick_task_scx() is called without preceding balance_scx()")
> Cc: stable@vger.kernel.org # v6.12+

Applied to sched_ext/for-6.14-fixes.

Thanks.

-- 
tejun

On Tue, Feb 25, 2025 at 06:02:23AM -1000, Tejun Heo wrote:
> a6250aa251ea ("sched_ext: Handle cases where pick_task_scx() is called
> without preceding balance_scx()") added a workaround to handle the cases
> where pick_task_scx() is called without prececing balance_scx() which is due
> to a fair class bug where pick_taks_fair() may return NULL after a true
> return from balance_fair().
> 
> The workaround detects when pick_task_scx() is called without preceding
> balance_scx() and emulates SCX_RQ_BAL_KEEP and triggers kicking to avoid
> stalling. Unfortunately, the workaround code was testing whether @prev was
> on SCX to decide whether to keep the task running. This is incorrect as the
> task may be on SCX but no longer runnable.
> 
> This could lead to a non-runnable task to be returned from pick_task_scx()
> which cause interesting confusions and failures. e.g. A common failure mode
> is the task ending up with (!on_rq && on_cpu) state which can cause
> potential wakers to busy loop, which can easily lead to deadlocks.
> 
> Fix it by testing whether @prev has SCX_TASK_QUEUED set. This makes
> $prev_on_scx only used in one place. Open code the usage and improve the

nit: @prev_on_scx?

> comment while at it.
> 
> Signed-off-by: Tejun Heo <tj@kernel.org>
> Reported-by: Pat Cody <patcody@meta.com>
> Fixes: a6250aa251ea ("sched_ext: Handle cases where pick_task_scx() is called without preceding balance_scx()")
> Cc: stable@vger.kernel.org # v6.12+

Makes sense to me.

Acked-by: Andrea Righi <arighi@nvidia.com>

Thanks,
-Andrea

> ---
>  kernel/sched/ext.c |   11 +++++++----
>  1 file changed, 7 insertions(+), 4 deletions(-)
> 
> diff --git a/kernel/sched/ext.c b/kernel/sched/ext.c
> index 5a81d9a1e31f..0f1da199cfc7 100644
> --- a/kernel/sched/ext.c
> +++ b/kernel/sched/ext.c
> @@ -3117,7 +3117,6 @@ static struct task_struct *pick_task_scx(struct rq *rq)
>  {
>  	struct task_struct *prev = rq->curr;
>  	struct task_struct *p;
> -	bool prev_on_scx = prev->sched_class == &ext_sched_class;
>  	bool keep_prev = rq->scx.flags & SCX_RQ_BAL_KEEP;
>  	bool kick_idle = false;
>  
> @@ -3137,14 +3136,18 @@ static struct task_struct *pick_task_scx(struct rq *rq)
>  	 * if pick_task_scx() is called without preceding balance_scx().
>  	 */
>  	if (unlikely(rq->scx.flags & SCX_RQ_BAL_PENDING)) {
> -		if (prev_on_scx) {
> +		if (prev->scx.flags & SCX_TASK_QUEUED) {
>  			keep_prev = true;
>  		} else {
>  			keep_prev = false;
>  			kick_idle = true;
>  		}
> -	} else if (unlikely(keep_prev && !prev_on_scx)) {
> -		/* only allowed during transitions */
> +	} else if (unlikely(keep_prev &&
> +			    prev->sched_class != &ext_sched_class)) {
> +		/*
> +		 * Can happen while enabling as SCX_RQ_BAL_PENDING assertion is
> +		 * conditional on scx_enabled() and may have been skipped.
> +		 */
>  		WARN_ON_ONCE(scx_ops_enable_state() == SCX_OPS_ENABLED);
>  		keep_prev = false;
>  	}

On Tue, Feb 25, 2025 at 06:14:15PM +0100, Andrea Righi wrote:
> > Fix it by testing whether @prev has SCX_TASK_QUEUED set. This makes
> > $prev_on_scx only used in one place. Open code the usage and improve the
> 
> nit: @prev_on_scx?

Yeah, I don't know. Some people use @ only for arguments and $ for
variables. Others always use @. I flip flop between them.

Thanks.

-- 
tejun