Re: [PATCH 4/4] sched/fair: Rework/fix task_h_load()

[Chen Yu <yu.c.chen@intel.com>]

On Fri, Aug 28, 2026 at 09:41:03AM +0200, Peter Zijlstra wrote:

[ ... ]

> @@ -15230,6 +15255,9 @@ static void set_next_task_fair(struct rq
>  			weight = __calc_prop_weight(cfs_rq, se, weight);
>  	}
>  
> +	for_each_sched_entity_bl(se, cfs_rq)
> +		update_cfs_rq_h_load(group_cfs_rq(se), se, cfs_rq);
> +

It panics during bootup on a 192 Cores system,
[    9.445362][ T1687] Oops: general protection fault, kernel NULL pointer dereference 0x69: 0000 [#1] SMP NOPTI
[   18.987940][ T1687] CPU: 58 UID: 0 PID: 1687 Comm: systemd-udevd Not tainted 7.3.0-rc1-flat-hload+ #9 PREEMPTLAZY 
[   19.022374][ T1687] RIP: 0010:pick_task_fair+0x43/0xd0
[   19.175316][ T1687]  <TASK>
[   19.181239][ T1687]  __pick_next_task+0x49/0x1b0
[   19.189229][ T1687]  __schedule+0x14b/0x6b0
[   19.196711][ T1687]  preempt_schedule+0x3a/0x60
[   19.204543][ T1687]  preempt_schedule_thunk+0x16/0x40
[   19.212931][ T1687]  _raw_spin_unlock_irqrestore+0x2b/0x30
[   19.221833][ T1687]  autogroup_move_group+0xc5/0x160
[   19.230124][ T1687]  sched_autogroup_create_attach+0xa7/0x180
[   19.239280][ T1687]  ksys_setsid+0x12c/0x170
[   19.246753][ T1687]  __do_sys_setsid+0xe/0x20
[   19.254292][ T1687]  do_syscall_64+0xbc/0x470
[   19.307858][ T1687]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
[   19.316405][ T1687] RIP: 0033:0x7f347bfbcb9b

It seems that the crash is a read of se->sched_delayed on a NULL se inside
pick_next_entity(), so pick_eevdf() return NULL

After the following top->down backlink traverse,
for_each_sched_entity_bl(se, cfs_rq)
    update_cfs_rq_h_load(group_cfs_rq(se), se, cfs_rq);

cfs_rq is not the root->cfs_rq anymore, but a middle cfs_rq(autogroup
in above example). Meanwhile rq->cfs.curr remains NULL because the
rq->cfs.curr has been dequeued if the task is runnable and queued:
if (on_rq)
	__dequeue_entity(cfs_rq, se)

se = &p->se;
cfs_rq->curr = se; /*wrong cfs_rq*/

Then later _raw_spin_unlock_irqrestore triggers the scheduling
it picks from rq->cfs_rq.curr with a NULL tree.

Maybe we need to restore the rq->cfs_rq after the
for_each_sched_entity_bl()?
se = &p->se;
cfs_rq = &rq->cfs; <--
cfs_rq->curr = se;

thanks,
Chenyu