[PATCH sched_ext/for-7.4-fixes] sched/core: Avoid requeueing a singleton balance callback

[PATCH sched_ext/for-7.4-fixes] sched/core: Avoid requeueing a singleton balance callback

[Andrea Righi]

With proxy execution, __schedule() can call set_next_task_scx() with
SNT_REPICK and then SNT_PICK for the same donor. Both calls queue the
kick_sync balance callback while kick_sync_pending remains set.

When the callback is the only list entry, its next pointer is NULL, so
the existing duplicate check misses it. Queueing it again links it to
itself and causes the wait to run twice.

Also check whether the callback is already the head of the list to
reject the second insertion.

This covers the kick_sync callback because nothing else is queued
between SNT_REPICK and SNT_PICK. Requeueing the tail of a longer list
remains possible and is outside the scope of this fix.

Fixes: e2859566ffbc ("sched_ext: Queue the kick_sync wait from set_next_task_scx()")
Reported-by: Tejun Heo <tj@kernel.org>
Link: https://lore.kernel.org/r/08cac02c604dd73ef96fc92eb29d692b@kernel.org
Signed-off-by: Andrea Righi <arighi@nvidia.com>
Acked-by: Tejun Heo <tj@kernel.org>
---
Resending including Peter, this touches kernel/sched/sched.h.

Original post:
https://lore.kernel.org/r/20261020084400.845842-2-arighi@nvidia.com

The triggering commit e2859566ffbc is only available in sched_ext/for-7.4-fixes,
so this fix is intended for the 7.4 cycle:

  git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext.git for-7.4-fixes

 kernel/sched/sched.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
index 499a5649582e7..2584d1a7f6d21 100644
--- a/kernel/sched/sched.h
+++ b/kernel/sched/sched.h
@@ -2158,7 +2158,8 @@ queue_balance_callback(struct rq *rq,
 	 * balance_push() is active, see the comment with
 	 * balance_push_callback.
 	 */
-	if (unlikely(head->next || rq->balance_callback == &balance_push_callback))
+	if (unlikely(head->next || rq->balance_callback == head ||
+		     rq->balance_callback == &balance_push_callback))
 		return;
 
 	head->func = func;
-- 
2.56.0

Re: [PATCH sched_ext/for-7.4-fixes] sched/core: Avoid requeueing a singleton balance callback

[Peter Zijlstra]

On Wed, Oct 21, 2026 at 09:05:35AM +0200, Andrea Righi wrote:
> With proxy execution, __schedule() can call set_next_task_scx() with
> SNT_REPICK and then SNT_PICK for the same donor. Both calls queue the
> kick_sync balance callback while kick_sync_pending remains set.
> 
> When the callback is the only list entry, its next pointer is NULL, so
> the existing duplicate check misses it. Queueing it again links it to
> itself and causes the wait to run twice.
> 
> Also check whether the callback is already the head of the list to
> reject the second insertion.
> 
> This covers the kick_sync callback because nothing else is queued
> between SNT_REPICK and SNT_PICK. Requeueing the tail of a longer list
> remains possible and is outside the scope of this fix.

Cute.

> Fixes: e2859566ffbc ("sched_ext: Queue the kick_sync wait from set_next_task_scx()")
> Reported-by: Tejun Heo <tj@kernel.org>
> Link: https://lore.kernel.org/r/08cac02c604dd73ef96fc92eb29d692b@kernel.org
> Signed-off-by: Andrea Righi <arighi@nvidia.com>
> Acked-by: Tejun Heo <tj@kernel.org>
> ---
> Resending including Peter, this touches kernel/sched/sched.h.
> 
> Original post:
> https://lore.kernel.org/r/20261020084400.845842-2-arighi@nvidia.com
> 
> The triggering commit e2859566ffbc is only available in sched_ext/for-7.4-fixes,
> so this fix is intended for the 7.4 cycle:
> 
>   git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext.git for-7.4-fixes

OK, probably best if TJ routes it then? in which case:

Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>

>  kernel/sched/sched.h | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
> index 499a5649582e7..2584d1a7f6d21 100644
> --- a/kernel/sched/sched.h
> +++ b/kernel/sched/sched.h
> @@ -2158,7 +2158,8 @@ queue_balance_callback(struct rq *rq,
>  	 * balance_push() is active, see the comment with
>  	 * balance_push_callback.
>  	 */
> -	if (unlikely(head->next || rq->balance_callback == &balance_push_callback))
> +	if (unlikely(head->next || rq->balance_callback == head ||
> +		     rq->balance_callback == &balance_push_callback))
>  		return;
>  
>  	head->func = func;
> -- 
> 2.56.0
>