Re: [PATCH] sched/core: Fix a TOCTOU bug in sched_non_preferred_cpu_push_stop()

[Shrikanth Hegde]

Hi Fushuai.

On 11/9/26 2:01 PM, Fushuai Wang wrote:
> From: Fushuai Wang <wangfushuai@xxxxxxxxx>
>
> sched_push_current_non_preferred_cpu() is called in irq context. It
> checks is_migration_disabled() before queuing the stopper, but the
> task may continue running and enter migrate_disable() before the stopper
> runs.
> Recheck is_migration_disabled() in sched_non_preferred_cpu_push_stop()
> before calling __migrate_task().
>
>    WARNING: kernel/sched/core.c:3432 at set_task_cpu+0x1b8/0xdf0, CPU#21: migration/21/152
>    Stopper: sched_non_preferred_cpu_push_stop+0x0/0xb10 <- sched_push_current_non_preferred_cpu+0x6a6/0x9a0
>    ...
>    Call Trace:
>     <TASK>
>     ? __this_cpu_preempt_check+0x13/0x20
>     move_queued_task+0xfc/0x650
>     ? is_cpu_allowed+0x341/0x820
>     ? __this_cpu_preempt_check+0x13/0x20
>     sched_non_preferred_cpu_push_stop+0x7b7/0xb10
>     ? __pfx_sched_non_preferred_cpu_push_stop+0x10/0x10
>     ...
>     </TASK>

How does rest of the stack look like? Is it disabling preemption where
stopper is not getting a chance to run before task sets migrate_disable?

> Fixes: 74699f56ebcf ("sched/core: Push current task from non preferred CPU")
> Signed-off-by: Fushuai Wang <wangfushuai@xxxxxxxxx>
> ---
>   kernel/sched/core.c | 3 ++-
>   1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/kernel/sched/core.c b/kernel/sched/core.c
> index 1a088d4576f5..8ed7613eafd6 100644
> --- a/kernel/sched/core.c
> +++ b/kernel/sched/core.c
> @@ -11317,7 +11317,8 @@ static int sched_non_preferred_cpu_push_stop(void *arg)
>   		rq->npc_push_work_pending = false;
>   		update_rq_clock(rq);
>   
> -		if (task_rq(p) == rq && task_on_rq_queued(p)) {
> +		if (task_rq(p) == rq && task_on_rq_queued(p) &&
> +		    !is_migration_disabled(p)) {
>   			struct rq *dest_rq = __migrate_task(rq, &rf, p, cpu);
>   

I thought it is unnecessary.
https://lore.kernel.org/all/4e2421fe-4b26-4d92-8709-bfa8d3a4114a@xxxxxxxxxxxxx/#t

Can you share how you are running into this?

>   			if (rq != dest_rq)