[PATCH] sched: Serialize cgroup updates to prevent CFS/SCX state divergence

[PATCH] sched: Serialize cgroup updates to prevent CFS/SCX state divergence

[Michal Blaszczyk]

Concurrent writes to cgroup control files (such as cpu.shares or
cpu.weight) can lead to state divergence between CFS and SCX.

For instance, in cpu_shares_write_u64(), the CFS update is serialized
by shares_mutex (internal to fair.c), but this lock is dropped before
scx_group_set_weight() is called. The latter only acquires a read
semaphore (scx_cgroup_ops_rwsem), allowing multiple threads to evaluate
and act on the sched_ext update concurrently.

This serialization gap allows concurrent writes to interleave.
As a result, the recorded state in CFS, the SCX internal bookkeeping
(e.g., tg->scx.weight), and the BPF scheduler itself can end up operating
on completely distinct parameters (pairwise distinct values).

Similar races are present in tg_set_bandwidth(), cpu_idle_write_s64(),
cpu_weight_write_u64(), and cpu_weight_nice_write_s64().

Fix this by introducing scx_cgroup_mutex in kernel/sched/core.c to
serialize these file write operations.

Fixes: 819513666966 ("sched_ext: Add cgroup support")
Signed-off-by: Michal Blaszczyk <michalblk@google.com>
---
 kernel/sched/core.c | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index f5f7ff8c680a..e3e84f7b9da9 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -9789,6 +9789,11 @@ static unsigned long tg_weight(struct task_group *tg)
 #endif
 }
 
+/* Serializes concurrent cgroup updates to keep CFS and SCX state consistent */
+#ifdef CONFIG_EXT_GROUP_SCHED
+static DEFINE_MUTEX(scx_cgroup_mutex);
+#endif
+
 static int cpu_shares_write_u64(struct cgroup_subsys_state *css,
 				struct cftype *cftype, u64 shareval)
 {
@@ -9796,6 +9801,10 @@ static int cpu_shares_write_u64(struct cgroup_subsys_state *css,
 
 	if (shareval > scale_load_down(ULONG_MAX))
 		shareval = MAX_SHARES;
+
+#ifdef CONFIG_EXT_GROUP_SCHED
+	guard(mutex)(&scx_cgroup_mutex);
+#endif
 	ret = sched_group_set_shares(css_tg(css), scale_load(shareval));
 	if (!ret)
 		scx_group_set_weight(css_tg(css),
@@ -10131,6 +10140,9 @@ static int tg_set_bandwidth(struct task_group *tg,
 					burst_us + quota_us > max_bw_runtime_us))
 		return -EINVAL;
 
+#ifdef CONFIG_EXT_GROUP_SCHED
+	guard(mutex)(&scx_cgroup_mutex);
+#endif
 #ifdef CONFIG_CFS_BANDWIDTH
 	ret = tg_set_cfs_bandwidth(tg, period_us, quota_us, burst_us);
 #endif /* CONFIG_CFS_BANDWIDTH */
@@ -10229,6 +10241,9 @@ static int cpu_idle_write_s64(struct cgroup_subsys_state *css,
 {
 	int ret;
 
+#ifdef CONFIG_EXT_GROUP_SCHED
+	guard(mutex)(&scx_cgroup_mutex);
+#endif
 	ret = sched_group_set_idle(css_tg(css), idle);
 	if (!ret)
 		scx_group_set_idle(css_tg(css), idle);
@@ -10405,6 +10420,9 @@ static int cpu_weight_write_u64(struct cgroup_subsys_state *css,
 
 	weight = sched_weight_from_cgroup(cgrp_weight);
 
+#ifdef CONFIG_EXT_GROUP_SCHED
+	guard(mutex)(&scx_cgroup_mutex);
+#endif
 	ret = sched_group_set_shares(css_tg(css), scale_load(weight));
 	if (!ret)
 		scx_group_set_weight(css_tg(css), cgrp_weight);
@@ -10442,6 +10460,9 @@ static int cpu_weight_nice_write_s64(struct cgroup_subsys_state *css,
 	idx = array_index_nospec(idx, 40);
 	weight = sched_prio_to_weight[idx];
 
+#ifdef CONFIG_EXT_GROUP_SCHED
+	guard(mutex)(&scx_cgroup_mutex);
+#endif
 	ret = sched_group_set_shares(css_tg(css), scale_load(weight));
 	if (!ret)
 		scx_group_set_weight(css_tg(css),
-- 
2.55.0.737.g08866a6d13-goog

Re: [PATCH] sched: Serialize cgroup updates to prevent CFS/SCX state divergence

[Tejun Heo]

Hello,

On Thu, Aug 20, 2026 at 04:09:56PM +0000, Michal Blaszczyk wrote:
> Concurrent writes to cgroup control files (such as cpu.shares or
> cpu.weight) can lead to state divergence between CFS and SCX.
> 
> For instance, in cpu_shares_write_u64(), the CFS update is serialized
> by shares_mutex (internal to fair.c), but this lock is dropped before
> scx_group_set_weight() is called. The latter only acquires a read
> semaphore (scx_cgroup_ops_rwsem), allowing multiple threads to evaluate
> and act on the sched_ext update concurrently.
> 
> This serialization gap allows concurrent writes to interleave.
> As a result, the recorded state in CFS, the SCX internal bookkeeping
> (e.g., tg->scx.weight), and the BPF scheduler itself can end up operating
> on completely distinct parameters (pairwise distinct values).
> 
> Similar races are present in tg_set_bandwidth(), cpu_idle_write_s64(),
> cpu_weight_write_u64(), and cpu_weight_nice_write_s64().
> 
> Fix this by introducing scx_cgroup_mutex in kernel/sched/core.c to
> serialize these file write operations.

I wonder whether a better way to do this is just taking out fair's
cpu.weight and .max locking into the core layer so that both callbacks are
called under the same locking. Peter, what do you think?

Thanks.

-- 
tejun

Re: [PATCH] sched: Serialize cgroup updates to prevent CFS/SCX state divergence

[Peter Zijlstra]

On Thu, Aug 20, 2026 at 07:21:01AM -1000, Tejun Heo wrote:
> Hello,
> 
> On Thu, Aug 20, 2026 at 04:09:56PM +0000, Michal Blaszczyk wrote:
> > Concurrent writes to cgroup control files (such as cpu.shares or
> > cpu.weight) can lead to state divergence between CFS and SCX.
> > 
> > For instance, in cpu_shares_write_u64(), the CFS update is serialized
> > by shares_mutex (internal to fair.c), but this lock is dropped before
> > scx_group_set_weight() is called. The latter only acquires a read
> > semaphore (scx_cgroup_ops_rwsem), allowing multiple threads to evaluate
> > and act on the sched_ext update concurrently.
> > 
> > This serialization gap allows concurrent writes to interleave.
> > As a result, the recorded state in CFS, the SCX internal bookkeeping
> > (e.g., tg->scx.weight), and the BPF scheduler itself can end up operating
> > on completely distinct parameters (pairwise distinct values).
> > 
> > Similar races are present in tg_set_bandwidth(), cpu_idle_write_s64(),
> > cpu_weight_write_u64(), and cpu_weight_nice_write_s64().
> > 
> > Fix this by introducing scx_cgroup_mutex in kernel/sched/core.c to
> > serialize these file write operations.
> 
> I wonder whether a better way to do this is just taking out fair's
> cpu.weight and .max locking into the core layer so that both callbacks are
> called under the same locking. Peter, what do you think?

Yeah, makes sense, no point in fair having an extra/superfluous layer of
locking if it is (also) needed in core.