linux-kernel - [PATCH] sched/deadline: Fix race in push_dl

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20250307204255.60640-1-harshit@nutanix.com>
Date: Fri,  7 Mar 2025 20:42:54 +0000
From: Harshit Agarwal <harshit@...anix.com>
To: Ingo Molnar <mingo@...hat.com>, Peter Zijlstra <peterz@...radead.org>,
        Juri Lelli <juri.lelli@...hat.com>,
        Vincent Guittot <vincent.guittot@...aro.org>,
        Dietmar Eggemann <dietmar.eggemann@....com>,
        Steven Rostedt <rostedt@...dmis.org>, Ben Segall <bsegall@...gle.com>,
        Mel Gorman <mgorman@...e.de>, Valentin Schneider <vschneid@...hat.com>,
        linux-kernel@...r.kernel.org
Cc: Harshit Agarwal <harshit@...anix.com>, stable@...r.kernel.org
Subject: [PATCH] sched/deadline: Fix race in push_dl_task

This fix is the deadline version of the change made to the rt scheduler
here:
https://lore.kernel.org/lkml/20250225180553.167995-1-harshit@nutanix.com/
Please go through the original change for more details on the issue.

In this fix we bail out or retry in the push_dl_task, if the task is no
longer at the head of pushable tasks list because this list changed
while trying to lock the runqueue of the other CPU.

Signed-off-by: Harshit Agarwal <harshit@...anix.com>
Cc: stable@...r.kernel.org
---
 kernel/sched/deadline.c | 25 +++++++++++++++++++++----
 1 file changed, 21 insertions(+), 4 deletions(-)

diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
index 38e4537790af..c5048969c640 100644
--- a/kernel/sched/deadline.c
+++ b/kernel/sched/deadline.c
@@ -2704,6 +2704,7 @@ static int push_dl_task(struct rq *rq)
 {
 	struct task_struct *next_task;
 	struct rq *later_rq;
+	struct task_struct *task;
 	int ret = 0;
 
 	next_task = pick_next_pushable_dl_task(rq);
@@ -2734,15 +2735,30 @@ static int push_dl_task(struct rq *rq)
 
 	/* Will lock the rq it'll find */
 	later_rq = find_lock_later_rq(next_task, rq);
-	if (!later_rq) {
-		struct task_struct *task;
+	task = pick_next_pushable_dl_task(rq);
+	if (later_rq && (!task || task != next_task)) {
+		/*
+		 * We must check all this again, since
+		 * find_lock_later_rq releases rq->lock and it is
+		 * then possible that next_task has migrated and
+		 * is no longer at the head of the pushable list.
+		 */
+		double_unlock_balance(rq, later_rq);
+		if (!task) {
+			/* No more tasks */
+			goto out;
+		}
 
+		put_task_struct(next_task);
+		next_task = task;
+		goto retry;
+	}
+	if (!later_rq) {
 		/*
 		 * We must check all this again, since
 		 * find_lock_later_rq releases rq->lock and it is
 		 * then possible that next_task has migrated.
 		 */
-		task = pick_next_pushable_dl_task(rq);
 		if (task == next_task) {
 			/*
 			 * The task is still there. We don't try
@@ -2751,9 +2767,10 @@ static int push_dl_task(struct rq *rq)
 			goto out;
 		}
 
-		if (!task)
+		if (!task) {
 			/* No more tasks */
 			goto out;
+		}
 
 		put_task_struct(next_task);
 		next_task = task;
-- 
2.22.3