[PATCH 1/4] sched/deadline: Fix stale root domain in cpuset bandwidth transfer

[Juri Lelli]

dl_task_needs_bw_move() and set_cpus_allowed_dl() use task_rq(p)->rd
to determine a task's current root domain. For a sleeping task, this
is stale: it points to the rq of the CPU the task last ran on, which
may belong to a different root domain after a cpuset move.

This causes incorrect bandwidth accounting when a sleeping DL task is
moved between exclusive cpuset partitions and back:

  1. Move root->partition: task_rq(p)->rd = root, destination in
     partition -> different -> bandwidth transferred correctly.
  2. Move partition->root: task_rq(p)->rd is still root (task never
     ran) -> looks like same domain -> no transfer. Partition keeps
     stale bandwidth, root domain is short.

The root domain then over-admits, and when the task exits total_bw
underflows.

Introduce dl_task_root_domain_cpu() helper that uses the task's
cpus_mask (which still reflects the old/source cpuset at call time)
to find the root domain where the bandwidth is actually accounted,
instead of relying on the potentially stale task_rq(p)->rd.

Use cpus_mask rather than cpus_ptr, as the latter may be temporarily
narrowed to a single CPU by migrate_disable().

Reported-by: Weiheng Qiu <weihengqiuu@xxxxxxxxx>
Closes: https://lore.kernel.org/all/14508cb2-805f-41ac-9f6b-bfd7c3d7cb1c@xxxxxxxxx/
Signed-off-by: Juri Lelli <juri.lelli@xxxxxxxxxx>
---
 kernel/sched/deadline.c | 31 ++++++++++++++++++++++++-------
 1 file changed, 24 insertions(+), 7 deletions(-)

diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
index c0ebdcde5fe5d..68019dafbaf18 100644
--- a/kernel/sched/deadline.c
+++ b/kernel/sched/deadline.c
@@ -3324,14 +3324,28 @@ static void task_woken_dl(struct rq *rq, struct task_struct *p)
 	}
 }
 
+/*
+ * Find the root domain where a DL task's bandwidth is currently
+ * accounted. For a sleeping task that was moved between cpusets
+ * without running, task_rq(p)->rd may be stale. Use the task's
+ * current cpus_mask (not yet updated to the new mask) to find the
+ * actual root domain. Use cpus_mask rather than cpus_ptr, which
+ * may be temporarily narrowed by migrate_disable().
+ */
+static unsigned int dl_task_root_domain_cpu(struct task_struct *p)
+{
+	unsigned int cpu;
+
+	cpu = cpumask_first_and(&p->cpus_mask, cpu_active_mask);
+	BUG_ON(cpu >= nr_cpu_ids);
+	return cpu;
+}
+
 static void set_cpus_allowed_dl(struct task_struct *p,
 				struct affinity_context *ctx)
 {
-	struct rq *rq;
-
 	WARN_ON_ONCE(!dl_task(p));
 
-	rq = task_rq(p);
 	/*
 	 * Migrating a SCHED_DEADLINE task between exclusive
 	 * cpusets (different root_domains) entails a bandwidth
@@ -3339,16 +3353,16 @@ static void set_cpus_allowed_dl(struct task_struct *p,
 	 * domain (see cpuset_can_attach()).
 	 */
 	if (dl_task_needs_bw_move(p, ctx->new_mask)) {
-		struct dl_bw *src_dl_b;
+		unsigned int src_cpu = dl_task_root_domain_cpu(p);
+		struct dl_bw *src_dl_b = &cpu_rq(src_cpu)->rd->dl_bw;
 
-		src_dl_b = dl_bw_of(cpu_of(rq));
 		/*
 		 * We now free resources of the root_domain we are migrating
 		 * off. In the worst case, sched_setattr() may temporary fail
 		 * until we complete the update.
 		 */
 		raw_spin_lock(&src_dl_b->lock);
-		__dl_sub(src_dl_b, p->dl.dl_bw, dl_bw_cpus(task_cpu(p)));
+		__dl_sub(src_dl_b, p->dl.dl_bw, dl_bw_cpus(src_cpu));
 		raw_spin_unlock(&src_dl_b->lock);
 	}
 
@@ -3358,10 +3372,13 @@ static void set_cpus_allowed_dl(struct task_struct *p,
 bool dl_task_needs_bw_move(struct task_struct *p,
 			   const struct cpumask *new_mask)
 {
+	unsigned int cpu;
+
 	if (!dl_task(p))
 		return false;
 
-	return !cpumask_intersects(task_rq(p)->rd->span, new_mask);
+	cpu = dl_task_root_domain_cpu(p);
+	return !cpumask_intersects(cpu_rq(cpu)->rd->span, new_mask);
 }
 
 /* Assumes rq->lock is held */

-- 
2.56.0