sched: Fix balance_push() vs __sched_setscheduler()

[ Upstream commit 04193d590b390ec7a0592630f46d559ec6564ba1 ]

The purpose of balance_push() is to act as a filter on task selection
in the case of CPU hotplug, specifically when taking the CPU out.

It does this by (ab)using the balance callback infrastructure, with
the express purpose of keeping all the unlikely/odd cases in a single
place.

In order to serve its purpose, the balance_push_callback needs to be
(exclusively) on the callback list at all times (noting that the
callback always places itself back on the list the moment it runs,
also noting that when the CPU goes down, regular balancing concerns
are moot, so ignoring them is fine).

And here-in lies the problem, __sched_setscheduler()'s use of
splice_balance_callbacks() takes the callbacks off the list across a
lock-break, making it possible for, an interleaving, __schedule() to
see an empty list and not get filtered.

Fixes: ae7927023243 ("sched: Optimize finish_lock_switch()")
Reported-by: Jing-Ting Wu <jing-ting.wu@mediatek.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Tested-by: Jing-Ting Wu <jing-ting.wu@mediatek.com>
Link: https://lkml.kernel.org/r/20220519134706.GH2578@worktop.programming.kicks-ass.net
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 838623b680311afa5135ad2d7079b151cc6a5a98..b89ca5c8314394ca8a8515dfb67174a48fbe0058 100644 (file)
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -4630,25 +4630,55 @@ static void do_balance_callbacks(struct rq *rq, struct callback_head *head)
 
 static void balance_push(struct rq *rq);
 
+/*
+ * balance_push_callback is a right abuse of the callback interface and plays
+ * by significantly different rules.
+ *
+ * Where the normal balance_callback's purpose is to be ran in the same context
+ * that queued it (only later, when it's safe to drop rq->lock again),
+ * balance_push_callback is specifically targeted at __schedule().
+ *
+ * This abuse is tolerated because it places all the unlikely/odd cases behind
+ * a single test, namely: rq->balance_callback == NULL.
+ */
 struct callback_head balance_push_callback = {
        .next = NULL,
        .func = (void (*)(struct callback_head *))balance_push,
 };
 
-static inline struct callback_head *splice_balance_callbacks(struct rq *rq)
+static inline struct callback_head *
+__splice_balance_callbacks(struct rq *rq, bool split)
 {
        struct callback_head *head = rq->balance_callback;
 
+       if (likely(!head))
+               return NULL;
+
        lockdep_assert_rq_held(rq);
-       if (head)
+       /*
+        * Must not take balance_push_callback off the list when
+        * splice_balance_callbacks() and balance_callbacks() are not
+        * in the same rq->lock section.
+        *
+        * In that case it would be possible for __schedule() to interleave
+        * and observe the list empty.
+        */
+       if (split && head == &balance_push_callback)
+               head = NULL;
+       else
                rq->balance_callback = NULL;
 
        return head;
 }
 
+static inline struct callback_head *splice_balance_callbacks(struct rq *rq)
+{
+       return __splice_balance_callbacks(rq, true);
+}
+
 static void __balance_callbacks(struct rq *rq)
 {
-       do_balance_callbacks(rq, splice_balance_callbacks(rq));
+       do_balance_callbacks(rq, __splice_balance_callbacks(rq, false));
 }
 
 static inline void balance_callbacks(struct rq *rq, struct callback_head *head)

diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
index f386c6c2b198bf968f00ddc902df9a7c68ebd356..fe8be2f8a47dc8996ab1573d5e251e456ff51ef1 100644 (file)
--- a/kernel/sched/sched.h
+++ b/kernel/sched/sched.h
@@ -1718,6 +1718,11 @@ queue_balance_callback(struct rq *rq,
 {
        lockdep_assert_rq_held(rq);
 
+       /*
+        * Don't (re)queue an already queued item; nor queue anything when
+        * balance_push() is active, see the comment with
+        * balance_push_callback.
+        */
        if (unlikely(head->next || rq->balance_callback == &balance_push_callback))
                return;