sched: Fix race between yield_to() and try_to_wake_up()

JIRA: https://issues.redhat.com/browse/RHEL-78821

commit 5d808c7
Author: Tianchen Ding <dtcccc@linux.alibaba.com>
Date:   Tue Dec 31 13:50:20 2024 +0800

    sched: Fix race between yield_to() and try_to_wake_up()

    We met a SCHED_WARN in set_next_buddy():
      __warn_printk
      set_next_buddy
      yield_to_task_fair
      yield_to
      kvm_vcpu_yield_to [kvm]
      ...

    After a short dig, we found the rq_lock held by yield_to() may not
    be exactly the rq that the target task belongs to. There is a race
    window against try_to_wake_up().

             CPU0                             target_task

                                            blocking on CPU1
       lock rq0 & rq1
       double check task_rq == p_rq, ok
                                            woken to CPU2 (lock task_pi & rq2)
                                            task_rq = rq2
       yield_to_task_fair (w/o lock rq2)

    In this race window, yield_to() is operating the task w/o the correct
    lock. Fix this by taking task pi_lock first.

    Fixes: d95f412 ("sched: Add yield_to(task, preempt) functionality")
    Signed-off-by: Tianchen Ding <dtcccc@linux.alibaba.com>
    Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
    Link: https://lkml.kernel.org/r/20241231055020.6521-1-dtcccc@linux.alibaba.com

Signed-off-by: Phil Auld <pauld@redhat.com>

Author: auldp

kernel/sched/syscalls.c

@@ -1557,7 +1557,7 @@ int __sched yield_to(struct task_struct *p, bool preempt)
 	struct rq *rq, *p_rq;
 	int yielded = 0;
 
-	scoped_guard (irqsave) {
+	scoped_guard (raw_spinlock_irqsave, &p->pi_lock) {
 		rq = this_rq();
 
 again: