[PATCHSET sched_ext/for-7.4-fixes] sched_ext: Fix proxy execution balance callbacks

[PATCHSET sched_ext/for-7.4-fixes] sched_ext: Fix proxy execution balance callbacks

[Andrea Righi]

This series addresses the three follow-ups you reported after applying
"sched_ext: Queue the kick_sync wait from set_next_task_scx()" [1].

The first patch prevents queue_balance_callback() from requeueing a
callback that is already the sole list entry. With proxy execution,
SNT_REPICK followed by SNT_PICK can otherwise queue the kick_sync
callback twice, linking it to itself and running the wait twice.

The second patch routes dispatch-time deferred actions through irq_work
when proxy execution is enabled. Proxy resolution can zap balance
callbacks and then select idle or another scheduling class, leaving no
SCX dispatch to restore the discarded deferred callback.

The third patch removes the now-unreachable foreign CPU check from the
kick_sync wait callback.

[1] https://lore.kernel.org/r/08cac02c604dd73ef96fc92eb29d692b@kernel.org

Andrea Righi (3):
  sched/core: Avoid requeueing a singleton balance callback
  sched_ext: Use irq_work for deferred actions with proxy execution
  sched_ext: Remove the foreign CPU check from the kick_sync wait

 kernel/sched/ext/ext.c | 18 +++++-------------
 kernel/sched/sched.h   |  3 ++-
 2 files changed, 7 insertions(+), 14 deletions(-)

[PATCH 1/3] sched/core: Avoid requeueing a singleton balance callback

[Andrea Righi]

With proxy execution, __schedule() can call set_next_task_scx() with
SNT_REPICK and then SNT_PICK for the same donor. Both calls queue the
kick_sync balance callback while kick_sync_pending remains set.

When the callback is the only list entry, its next pointer is NULL, so
the existing duplicate check misses it. Queueing it again links it to
itself and causes the wait to run twice.

Also check whether the callback is already the head of the list to
reject the second insertion.

Fixes: e2859566ffbc ("sched_ext: Queue the kick_sync wait from set_next_task_scx()")
Reported-by: Tejun Heo <tj@kernel.org>
Link: https://lore.kernel.org/r/08cac02c604dd73ef96fc92eb29d692b@kernel.org
Signed-off-by: Andrea Righi <arighi@nvidia.com>
---
 kernel/sched/sched.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
index 9e7993256c817..628765910934a 100644
--- a/kernel/sched/sched.h
+++ b/kernel/sched/sched.h
@@ -2175,7 +2175,8 @@ queue_balance_callback(struct rq *rq,
 	 * balance_push() is active, see the comment with
 	 * balance_push_callback.
 	 */
-	if (unlikely(head->next || rq->balance_callback == &balance_push_callback))
+	if (unlikely(head->next || rq->balance_callback == head ||
+		     rq->balance_callback == &balance_push_callback))
 		return;
 
 	head->func = func;
-- 
2.56.0

Re: [PATCH 1/3] sched/core: Avoid requeueing a singleton balance callback

[Tejun Heo]

On Tue, Oct 20, 2026 at 10:43:19AM +0200, Andrea Righi wrote:
> With proxy execution, __schedule() can call set_next_task_scx() with
> SNT_REPICK and then SNT_PICK for the same donor. Both calls queue the
> kick_sync balance callback while kick_sync_pending remains set.
> 
> When the callback is the only list entry, its next pointer is NULL, so
> the existing duplicate check misses it. Queueing it again links it to
> itself and causes the wait to run twice.
> 
> Also check whether the callback is already the head of the list to
> reject the second insertion.
> 
> Fixes: e2859566ffbc ("sched_ext: Queue the kick_sync wait from set_next_task_scx()")
> Reported-by: Tejun Heo <tj@kernel.org>
> Link: https://lore.kernel.org/r/08cac02c604dd73ef96fc92eb29d692b@kernel.org
> Signed-off-by: Andrea Righi <arighi@nvidia.com>

Can you resend this to Peter? Please feel free to add

 Acked-by: Tejun Heo <tj@kernel.org>

Thanks.

-- 
tejun

[PATCH 2/3] sched_ext: Use irq_work for deferred actions with proxy execution

[Andrea Righi]

maybe_queue_balance_callback() clears SCX_RQ_BAL_CB_PENDING when it
queues the deferred callback. Proxy resolution can then zap the callback
without running it, leaving the deferred actions unscheduled until a
later wakeup or deferred request.

Use the existing irq_work fallback for dispatch-time deferred requests
when proxy execution is enabled. This keeps the work scheduled even if
proxy resolution retries the pick or falls back to idle, without relying
on another SCX dispatch to restore a discarded callback.

Fixes: a8ad873113d3 ("sched_ext: defer queue_balance_callback() until after ops.dispatch")
Reported-by: Tejun Heo <tj@kernel.org>
Link: https://lore.kernel.org/r/08cac02c604dd73ef96fc92eb29d692b@kernel.org
Signed-off-by: Andrea Righi <arighi@nvidia.com>
---
 kernel/sched/ext/ext.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/kernel/sched/ext/ext.c b/kernel/sched/ext/ext.c
index 5efc3ad1b1198..4b7d2602b4d40 100644
--- a/kernel/sched/ext/ext.c
+++ b/kernel/sched/ext/ext.c
@@ -1129,9 +1129,10 @@ static void schedule_deferred_locked(struct rq *rq)
 		return;
 
 	/*
-	 * If in dispatch, the balance callbacks will be called before rq lock
-	 * is released. Schedule one.
-	 *
+	 * If in dispatch without proxy execution, the balance callbacks will
+	 * be called before rq lock is released. Schedule one. With proxy
+	 * execution, proxy resolution can zap the callbacks without another
+	 * SCX dispatch to requeue them, so use irq_work instead.
 	 *
 	 * We can't directly insert the callback into the
 	 * rq's list: The call can drop its lock and make the pending balance
@@ -1139,7 +1140,7 @@ static void schedule_deferred_locked(struct rq *rq)
 	 *
 	 * Just let dispatch_one() know that it must do it itself.
 	 */
-	if (rq->scx.flags & SCX_RQ_IN_DISPATCH) {
+	if ((rq->scx.flags & SCX_RQ_IN_DISPATCH) && !sched_proxy_exec()) {
 		rq->scx.flags |= SCX_RQ_BAL_CB_PENDING;
 		return;
 	}
-- 
2.56.0

[PATCH 3/3] sched_ext: Remove the foreign CPU check from the kick_sync wait

[Andrea Righi]

The kick_sync balance callback is now queued from set_next_task_scx()
after the core-wide selection has finished. Proxy resolution zaps the
callbacks before dropping the rq lock, so a foreign CPU cannot acquire
the lock and flush this callback while it is queued.

Remove the unreachable foreign CPU check and its obsolete comment.

Suggested-by: Tejun Heo <tj@kernel.org>
Link: https://lore.kernel.org/r/08cac02c604dd73ef96fc92eb29d692b@kernel.org
Signed-off-by: Andrea Righi <arighi@nvidia.com>
---
 kernel/sched/ext/ext.c | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/kernel/sched/ext/ext.c b/kernel/sched/ext/ext.c
index 4b7d2602b4d40..a9b26fa431bf3 100644
--- a/kernel/sched/ext/ext.c
+++ b/kernel/sched/ext/ext.c
@@ -3733,15 +3733,6 @@ static void kick_sync_wait_bal_cb(struct rq *rq)
 	bool waited;
 	s32 cpu;
 
-	/*
-	 * This callback is queued once the pick is final and flushed within
-	 * @rq's own scheduling pass. If a lock taker on a foreign CPU ever
-	 * flushes it, the snapshots are unrelated to that CPU. Don't get in the
-	 * way and leave the wait pending for @rq's next pick.
-	 */
-	if (unlikely(cpu_of(rq) != smp_processor_id()))
-		return;
-
 	/*
 	 * Clear only when the wait actually runs. The callback can be dropped
 	 * without running (e.g., proxy exec zaps the balance callbacks and
-- 
2.56.0