[PATCH] sched/deadline: Fix race in push_dl_task

[Harshit Agarwal <harshit@nutanix.com>]

This fix is the deadline version of the change made to the rt scheduler
here:
https://lore.kernel.org/lkml/20250225180553.167995-1-harshit@nutanix.com/
Please go through the original change for more details on the issue.

In this fix we bail out or retry in the push_dl_task, if the task is no
longer at the head of pushable tasks list because this list changed
while trying to lock the runqueue of the other CPU.

Signed-off-by: Harshit Agarwal <harshit@nutanix.com>
Cc: stable@vger.kernel.org
---
 kernel/sched/deadline.c | 25 +++++++++++++++++++++----
 1 file changed, 21 insertions(+), 4 deletions(-)

diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
index 38e4537790af..c5048969c640 100644
--- a/kernel/sched/deadline.c
+++ b/kernel/sched/deadline.c
@@ -2704,6 +2704,7 @@ static int push_dl_task(struct rq *rq)
 {
 	struct task_struct *next_task;
 	struct rq *later_rq;
+	struct task_struct *task;
 	int ret = 0;
 
 	next_task = pick_next_pushable_dl_task(rq);
@@ -2734,15 +2735,30 @@ static int push_dl_task(struct rq *rq)
 
 	/* Will lock the rq it'll find */
 	later_rq = find_lock_later_rq(next_task, rq);
-	if (!later_rq) {
-		struct task_struct *task;
+	task = pick_next_pushable_dl_task(rq);
+	if (later_rq && (!task || task != next_task)) {
+		/*
+		 * We must check all this again, since
+		 * find_lock_later_rq releases rq->lock and it is
+		 * then possible that next_task has migrated and
+		 * is no longer at the head of the pushable list.
+		 */
+		double_unlock_balance(rq, later_rq);
+		if (!task) {
+			/* No more tasks */
+			goto out;
+		}
 
+		put_task_struct(next_task);
+		next_task = task;
+		goto retry;
+	}
+	if (!later_rq) {
 		/*
 		 * We must check all this again, since
 		 * find_lock_later_rq releases rq->lock and it is
 		 * then possible that next_task has migrated.
 		 */
-		task = pick_next_pushable_dl_task(rq);
 		if (task == next_task) {
 			/*
 			 * The task is still there. We don't try
@@ -2751,9 +2767,10 @@ static int push_dl_task(struct rq *rq)
 			goto out;
 		}
 
-		if (!task)
+		if (!task) {
 			/* No more tasks */
 			goto out;
+		}
 
 		put_task_struct(next_task);
 		next_task = task;
-- 
2.22.3