WARNING at kernel/sched/ext.c:3227 scx_cgroup_move_task+0xa8/0xb0

[Matt Fleming <matt@readmodwrite.com>]

Hi,

We're hitting a WARN_ON_ONCE in scx_cgroup_move_task() while running
scx_lavd. The stack is:

    scx_cgroup_move_task+0xa8/0xb0
    sched_move_task+0x134/0x290
    cpu_cgroup_attach+0x39/0x70
    cgroup_migrate_execute+0x37d/0x450
    cgroup_update_dfl_csses+0x1e3/0x270
    cgroup_subtree_control_write+0x3e7/0x440

The trigger is systemd's user@UID.service startup. The user manager
writes +cpu +memory +pids to its own subtree_control. Because +cpu is
already inherited, the cpu task_group doesn't change -- but
find_css_set() returns a css_set whose subsys[cpu] pointer differs
from the source (different css object, same tg_cgrp()). That sets
the cpu bit in mgctx->ss_mask, so both cpu_cgroup_can_attach() and
cpu_cgroup_attach() run.

scx_cgroup_can_attach() checks "from == to" in tg_cgrp() and skips the
task, leaving cgrp_moving_from NULL. But cpu_cgroup_attach() calls
sched_move_task() unconditionally, so scx_cgroup_move_task() fires and
WARNs on the NULL.

I managed to reproduce by cycling systemctl stop/start
user@UID.service. The hit rate varies with css_set cache state.

Any thoughts on the best way to resolve this?

Thanks,
Matt