Commit b34c82777a2c for kernel

commit b34c82777a2c0648ee053595f4b290fd5249b093
Author: David Carlier <devnexen@gmail.com>
Date:   Thu Apr 30 10:27:47 2026 +0100

    sched_ext: idle: Recheck prev_cpu after narrowing allowed mask

    scx_select_cpu_dfl() narrows @allowed to @cpus_allowed & @p->cpus_ptr
    when the BPF caller supplies a @cpus_allowed that differs from
    @p->cpus_ptr and @p doesn't have full affinity. However,
    @is_prev_allowed was computed against the original (wider)
    @cpus_allowed, so the prev_cpu fast paths could pick a @prev_cpu that
    is in @cpus_allowed but not in @p->cpus_ptr, violating the intended
    invariant that the returned CPU is always usable by @p. The kernel
    masks this via the SCX_EV_SELECT_CPU_FALLBACK fallback, but the
    behavior contradicts the documented contract.

    Move the @is_prev_allowed evaluation past the narrowing block so it
    tests against the final @allowed mask.

    Fixes: ee9a4e92799d ("sched_ext: idle: Properly handle invalid prev_cpu during idle selection")
    Cc: stable@vger.kernel.org # v6.16+
    Assisted-by: Claude <noreply@anthropic.com>
    Signed-off-by: David Carlier <devnexen@gmail.com>
    Reviewed-by: Andrea Righi <arighi@nvidia.com>
    Signed-off-by: Tejun Heo <tj@kernel.org>

diff --git a/kernel/sched/ext_idle.c b/kernel/sched/ext_idle.c
index 7468560a6d80..6e1980763270 100644
--- a/kernel/sched/ext_idle.c
+++ b/kernel/sched/ext_idle.c
@@ -465,12 +465,6 @@ s32 scx_select_cpu_dfl(struct task_struct *p, s32 prev_cpu, u64 wake_flags,

 	preempt_disable();

-	/*
-	 * Check whether @prev_cpu is still within the allowed set. If not,
-	 * we can still try selecting a nearby CPU.
-	 */
-	is_prev_allowed = cpumask_test_cpu(prev_cpu, allowed);
-
 	/*
 	 * Determine the subset of CPUs usable by @p within @cpus_allowed.
 	 */
@@ -487,6 +481,12 @@ s32 scx_select_cpu_dfl(struct task_struct *p, s32 prev_cpu, u64 wake_flags,
 		}
 	}

+	/*
+	 * Check whether @prev_cpu is still within the allowed set. If not,
+	 * we can still try selecting a nearby CPU.
+	 */
+	is_prev_allowed = cpumask_test_cpu(prev_cpu, allowed);
+
 	/*
 	 * This is necessary to protect llc_cpus.
 	 */