Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Subject: Re: Crash in fair scheduler
To:     "Schmid, Carsten" <Carsten_Schmid@mentor.com>,
        "mingo@redhat.com" <mingo@redhat.com>,
        "peterz@infradead.org" <peterz@infradead.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
References: <1575364273836.74450@mentor.com>
From:   Valentin Schneider <valentin.schneider@arm.com>
Message-ID: <564e45cb-8230-9c3d-24a8-b58e6e88349f@arm.com>
Date:   Tue, 3 Dec 2019 10:30:26 +0000
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101
 Thunderbird/60.9.0
MIME-Version: 1.0
In-Reply-To: <1575364273836.74450@mentor.com>
Content-Type: text/plain; charset=windows-1252
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On 03/12/2019 09:11, Schmid, Carsten wrote:
[...]

> set_next_entity(struct cfs_rq *cfs_rq, struct sched_entity *se)
> {
> 	/* 'current' is not kept within the tree. */
> 	if (se->on_rq) { <<<<<<< crash here
> 
> set_next_entity is called from within pick_next_task_fair, from the following piece of code:
> static struct task_struct *
> pick_next_task_fair(struct rq *rq, struct task_struct *prev, struct rq_flags *rf)
> {
> 	struct cfs_rq *cfs_rq = &rq->cfs;
> 	struct sched_entity *se;
> 	struct task_struct *p;
> 	int new_tasks;
> 
> again:
> 	if (!cfs_rq->nr_running) // this is 1, so we are not going to idle
> 		goto idle;
> 
> #ifdef CONFIG_FAIR_GROUP_SCHED
> 	if (prev->sched_class != &fair_sched_class) <<<<< this is true:
> 							crash> p &fair_sched_class
> 							$1 = (const struct sched_class *) 0xffffffffaaa10cc0 <<<<
> 							crash> $prev=ffff99a97895a580
> 							crash> gdb set $prev=(struct task_struct *)0xffff99a97895a580
> 							crash> p $prev->sched_class
> 							$2 = (const struct sched_class *) 0xffffffffaaa10b40 <<<<
> 		goto simple; <<<< so we go to simple
> ....
> (Line 6360, Kernel 4.14.86; Line 6820 Kernel v5.4-rc2)
> simple:
> #endif
> 
> 	put_prev_task(rq, prev);
> 
> 	do {
> 		se = pick_next_entity(cfs_rq, NULL); <<<< this returns se=NULL
> 		set_next_entity(cfs_rq, se); <<<<<<<< here we crash
> 		cfs_rq = group_cfs_rq(se);
> 	} while (cfs_rq);
> 
> So why is se = NULL returned?


That looks a lot like a recent issue we've had, see

  https://lore.kernel.org/lkml/20191108131909.428842459@infradead.org/

The issue is caused by
  
  67692435c411 ("sched: Rework pick_next_task() slow-path")

which 5.4-rc2 has (without the fix which landed in -rc7) but 4.14 really
shouldn't, unless the kernel you're using has had core scheduling somehow
backported to it?

I've only scraped the surface but I'd like to first ask: can you reproduce
the issue on v5.4 final ?

> Best regards
> Carsten
>