Commit b34c8277 authored by David Carlier's avatar David Carlier Committed by Tejun Heo
Browse files

sched_ext: idle: Recheck prev_cpu after narrowing allowed mask 



scx_select_cpu_dfl() narrows @allowed to @cpus_allowed & @p->cpus_ptr
when the BPF caller supplies a @cpus_allowed that differs from
@p->cpus_ptr and @p doesn't have full affinity. However,
@is_prev_allowed was computed against the original (wider)
@cpus_allowed, so the prev_cpu fast paths could pick a @prev_cpu that
is in @cpus_allowed but not in @p->cpus_ptr, violating the intended
invariant that the returned CPU is always usable by @p. The kernel
masks this via the SCX_EV_SELECT_CPU_FALLBACK fallback, but the
behavior contradicts the documented contract.

Move the @is_prev_allowed evaluation past the narrowing block so it
tests against the final @allowed mask.

Fixes: ee9a4e92 ("sched_ext: idle: Properly handle invalid prev_cpu during idle selection")
Cc: stable@vger.kernel.org # v6.16+
Assisted-by: default avatarClaude <noreply@anthropic.com>
Signed-off-by: default avatarDavid Carlier <devnexen@gmail.com>
Reviewed-by: default avatarAndrea Righi <arighi@nvidia.com>
Signed-off-by: default avatarTejun Heo <tj@kernel.org>
parent ff9eda4e

kernel/sched/ext_idle.c

+6 −6
Original line number Diff line number Diff line
@@ -465,12 +465,6 @@ s32 scx_select_cpu_dfl(struct task_struct *p, s32 prev_cpu, u64 wake_flags, 


	preempt_disable();



	/*

	 * Check whether @prev_cpu is still within the allowed set. If not,

	 * we can still try selecting a nearby CPU.

	 */

	is_prev_allowed = cpumask_test_cpu(prev_cpu, allowed);



	/*

	 * Determine the subset of CPUs usable by @p within @cpus_allowed.

	 */
@@ -487,6 +481,12 @@ s32 scx_select_cpu_dfl(struct task_struct *p, s32 prev_cpu, u64 wake_flags, 
		}

	}



	/*

	 * Check whether @prev_cpu is still within the allowed set. If not,

	 * we can still try selecting a nearby CPU.

	 */

	is_prev_allowed = cpumask_test_cpu(prev_cpu, allowed);



	/*

	 * This is necessary to protect llc_cpus.

	 */