[PATCH] sched/core: Fix a TOCTOU bug in sched_non_preferred_cpu_push_stop()

[PATCH] sched/core: Fix a TOCTOU bug in sched_non_preferred_cpu_push_stop()

[Fushuai Wang]

From: Fushuai Wang <wangfushuai@baidu.com>

sched_push_current_non_preferred_cpu() is called in irq context. It
checks is_migration_disabled() before queuing the stopper, but the
task may continue running and enter migrate_disable() before the stopper
runs.
Recheck is_migration_disabled() in sched_non_preferred_cpu_push_stop()
before calling __migrate_task().

  WARNING: kernel/sched/core.c:3432 at set_task_cpu+0x1b8/0xdf0, CPU#21: migration/21/152
  Stopper: sched_non_preferred_cpu_push_stop+0x0/0xb10 <- sched_push_current_non_preferred_cpu+0x6a6/0x9a0
  ...
  Call Trace:
   <TASK>
   ? __this_cpu_preempt_check+0x13/0x20
   move_queued_task+0xfc/0x650
   ? is_cpu_allowed+0x341/0x820
   ? __this_cpu_preempt_check+0x13/0x20
   sched_non_preferred_cpu_push_stop+0x7b7/0xb10
   ? __pfx_sched_non_preferred_cpu_push_stop+0x10/0x10
   ...
   </TASK>

Fixes: 74699f56ebcf ("sched/core: Push current task from non preferred CPU")
Signed-off-by: Fushuai Wang <wangfushuai@baidu.com>
---
 kernel/sched/core.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 1a088d4576f5..8ed7613eafd6 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -11317,7 +11317,8 @@ static int sched_non_preferred_cpu_push_stop(void *arg)
 		rq->npc_push_work_pending = false;
 		update_rq_clock(rq);
 
-		if (task_rq(p) == rq && task_on_rq_queued(p)) {
+		if (task_rq(p) == rq && task_on_rq_queued(p) &&
+		    !is_migration_disabled(p)) {
 			struct rq *dest_rq = __migrate_task(rq, &rf, p, cpu);
 
 			if (rq != dest_rq)
-- 
2.36.1