Merge tag 'sched-urgent-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

88328f85 · Linus Torvalds <[email protected]> · 2026-10-18 07:35:30 -10:00

Pull scheduler fixes from Ingo Molnar:

 - Fix __sched_setscheduler() class change race causing
   lost reschedules, exposed by recent RCU changes (K Prateek Nayak)

 - Fix s64 multiplication overflow in place_entity()'s vlag
   scaling code that can corrupt an entity's placement (Hui Su)

* tag 'sched-urgent-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  sched/fair: Avoid overflow in place_entity()
  sched/core: Call wakeup_preempt() for queued tasks during class change

Commit: 88328f850d956d267d11e2ee225ee1eaa902b8e0
Parents: 85737870 · 2f93bcb3

Merge commit. Changes below are compared with the first parent: 85737870.

Changes

2 files changed · +21 −14

File	Status	Add	Del	Content
kernel/sched/core.c	modified	+9	−10	View file
kernel/sched/fair.c	modified	+12	−4	View file

kernel/sched/core.c

View file

diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 1fe40de..1754d9f 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -11327,18 +11327,17 @@ void sched_change_end(struct sched_change_ctx *ctx)
 		if (p->sched_class->switched_to)
 			p->sched_class->switched_to(rq, p);
 
+		/*
+		 * Check if the task can preempt the current in case the class
+		 * was upgraded. Note that none of the switch*_from() methods
+		 * know the new class and none of the switch*_to() methods know
+		 * the old class so we must resched here.
+		 */
+		if (ctx->queued)
+			wakeup_preempt(rq, p, 0);
+
 		if (ctx->running) {
 			/*
-			 * If this was a class promotion; let the old class
-			 * know it got preempted. Note that none of the
-			 * switch*_from() methods know the new class and none
-			 * of the switch*_to() methods know the old class.
-			 */
-			if (sched_class_above(p->sched_class, ctx->class)) {
-				rq->next_class->wakeup_preempt(rq, p, 0);
-				rq->next_class = p->sched_class;
-			}
-			/*
 			 * If this was a degradation in class; make sure to
 			 * reschedule.
 			 */

kernel/sched/fair.c

View file

diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 57360f5..0f23644 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -6463,12 +6463,20 @@ place_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, int flags)
 		load = cfs_rq->sum_weight;
 		if (curr && curr->on_rq)
 			load += avg_vruntime_weight(cfs_rq, curr->h_load.weight);
-
-		weight = avg_vruntime_weight(cfs_rq, se->h_load.weight);
-		lag *= load + weight;
 		if (WARN_ON_ONCE(!load))
 			load = 1;
-		lag = div64_long(lag, load);
+
+		weight = avg_vruntime_weight(cfs_rq, se->h_load.weight);
+
+		/*
+		 * Rewrite, because the product (W + w_i)*vl'_i might
+		 * overflow s64:
+		 *
+		 *   vl_i = (W + w_i)*vl'_i / W
+		 *        = (W*vl'_i + w_i*vl'_i) / W
+		 *        = vl'_i + w_i*vl'_i/W
+		 */
+		lag += div64_long(lag * weight, load);
 
 		/*
 		 * A heavy entity (relative to the tree) will pull the