Re: [PATCH v3 7/7] sched/eevdf: Move to a single runqueue

[Peter Zijlstra]

On Sat, Jun 20, 2026 at 11:54:22AM +0800, Chen, Yu C wrote:

> A divide-by-zero crash is observed when running hackbench:
> 
>   [14697.488452] CPU: 112 UID: 0 PID: 124791 Comm: hackbench Not tainted
> 7.1.0-rc2+
>   [14697.492627] RIP: 0010:propagate_entity_load_avg+0x35f/0x3e0
>   [14697.506799]  <TASK>
>   [14697.507411]  __dequeue_task+0x2b4/0xc70
>   [14697.508677]  dequeue_task_fair+0x36/0x370
>   [14697.509047]  dequeue_task+0x101/0x2f0
>   [14697.509426]  __schedule+0x1b1/0x1a00
>   [14697.510868]  anon_pipe_read+0x3da/0x450
>   [14697.511400]  vfs_read+0x361/0x390
>   [14697.512053]  __x64_sys_read+0x19/0x30
> 
> The divide-by-zero happens here:
> 
> if (scale_load_down(gcfs_rq->load.weight)) {
>         load_sum = div_u64(gcfs_rq->avg.load_sum,
>                 scale_load_down(gcfs_rq->load.weight));
> }
> 
> gcfs_rq->load.weight is an insane large value and is truncated
> to the lower 32 bits by div_u64, which happen to be 0.
> 
> Using AI for investigation, the cause is a u32 overflow in
> update_tg_cfs_runnable(), and flat pickup became a victim when using
> tg_tasks():
> 
>   u32 new_sum, divider;
>   ...
>   new_sum = se->avg.runnable_avg * divider; <-- boom
> 
> The following sequence shows how this triggers the crash:
> 
>   propagate_entity_load_avg()
>     update_tg_cfs_runnable()     # u32 overflow corrupts runnable_sum
> 
>   __update_load_avg_cfs_rq()
>     ___update_load_avg()         # computes insane runnable_avg
>   update_tg_load_avg()           # propagates to tg->runnable_avg
> 
>   update_cfs_group()
>     calc_concur_shares()
>       tg_tasks()                 # long-to-int truncation, negative nr
>     reweight_entity()            # corrupted se->load.weight
>       update_load_add()          # corrupted cfs_rq->load.weight
> 
>   propagate_entity_load_avg()
>     update_tg_cfs_load()
>       div_u64()                  # divide-by-zero
> 
> Fix by widening new_sum from u32 to u64(no need to force tg_tasks()
> to return unsigned long after this fix)
> Assisted-by: Claude:claude-opus-4.6
> Signed-off-by: Chen Yu <yu.c.chen@xxxxxxxxx>
> ---
>  kernel/sched/fair.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
> index d991ea85873a..99ea51448981 100644
> --- a/kernel/sched/fair.c
> +++ b/kernel/sched/fair.c
> @@ -5305,7 +5305,8 @@ static inline void
>  update_tg_cfs_runnable(struct cfs_rq *cfs_rq, struct sched_entity *se, struct cfs_rq *gcfs_rq)
>  {
>  	long delta_sum, delta_avg = gcfs_rq->avg.runnable_avg - se->avg.runnable_avg;
> -	u32 new_sum, divider;
> +	u64 new_sum;
> +	u32 divider;
> 
>  	/* Nothing to update */
>  	if (!delta_avg)
> @@ -5319,7 +5320,7 @@ update_tg_cfs_runnable(struct cfs_rq *cfs_rq, struct sched_entity *se, struct cf
> 
>  	/* Set new sched_entity's runnable */
>  	se->avg.runnable_avg = gcfs_rq->avg.runnable_avg;
> -	new_sum = se->avg.runnable_avg * divider;
> +	new_sum = (u64)se->avg.runnable_avg * divider;
>  	delta_sum = (long)new_sum - (long)se->avg.runnable_sum;
>  	se->avg.runnable_sum = new_sum;

Hmm, nice one. This makes sense because sched_avg::runnable_sum is a u64
itself, so having the delta be one is only sensible.

I do wonder though, this doesn't actually look to be specific to flat,
it just managed to trip it somehow.

I'll stick this on as a separate fix.