From: David Carlier <devnexen@gmail.com>
To: Tejun Heo <tj@kernel.org>
Cc: sched-ext@lists.linux.dev, linux-kernel@vger.kernel.org
Subject: [BUG] sched_ext: ops.sub_ecaps_updated() dispatch context is set up on the wrong CPU under core scheduling
Date: Thu, 13 Aug 2026 05:59:31 +0100 [thread overview]
Message-ID: <20260813045931.8691-1-devnexen@gmail.com> (raw)
Hello,
scx_process_sync_ecaps() looks like a missed instance of the bug class
3dd52416e44a ("sched_ext: Fix this_rq() assumptions in dispatch kfuncs")
fixed: before invoking ops.sub_ecaps_updated() it does
struct scx_dsp_ctx *dspc = &pcpu->dsp_ctx;
dspc->rq = rq;
where @pcpu is the *target* CPU's context (recovered from the llist node),
while the dispatch kfuncs resolve theirs with this_cpu_ptr(sch->pcpu).
Identical until dispatch_core_pick() started running balance_one() for
sibling rqs - now a sync processed by a sibling calls the op with the
executing CPU's dsp_ctx.rq unset.
Nothing ever writes a sub's dsp_ctx.rq on a CPU before the first
scx_bpf_sub_dispatch() there, so it is NULL at attach time - exactly when
the initial cap-grant notifications fire. If the op then calls e.g.
scx_bpf_dsq_move_to_local() (it has SCX_KF_ALLOW_DISPATCH) on a non-empty
DSQ, scx_consume_dispatch_q(sch, NULL, ...) reaches
task_can_run_on_remote_rq() -> cpu_of(NULL) and oopses in the pick path.
A leftover rq from an earlier dispatch instead consumes toward the wrong
rq.
Fix seems to be a one-liner matching scx_dispatch_sched():
- struct scx_dsp_ctx *dspc = &pcpu->dsp_ctx;
+ struct scx_dsp_ctx *dspc =
+ &this_cpu_ptr(pcpu->sch->pcpu)->dsp_ctx;
with Fixes: b81a6c018cde ("sched_ext: Add sub_ecaps_updated()
effective-cap change notifier"). Happy to send a patch if nobody is on it,
or feel free to just fix it directly.
Cheers !
reply other threads:[~2026-08-13 4:59 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260813045931.8691-1-devnexen@gmail.com \
--to=devnexen@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=sched-ext@lists.linux.dev \
--cc=tj@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.