1 files changed, 26 insertions, 3 deletions

diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 0902e4d72671..9b786704d34b 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -5183,24 +5183,47 @@ static void migrate_tasks(struct rq *dead_rq)
                         break;
 
                 /*
-                 * Ensure rq->lock covers the entire task selection
-                 * until the migration.
+                 * pick_next_task assumes pinned rq->lock.
                  */
                 lockdep_pin_lock(&rq->lock);
                 next = pick_next_task(rq, &fake_task);
                 BUG_ON(!next);
                 next->sched_class->put_prev_task(rq, next);
 
+                /*
+                 * Rules for changing task_struct::cpus_allowed are holding
+                 * both pi_lock and rq->lock, such that holding either
+                 * stabilizes the mask.
+                 *
+                 * Drop rq->lock is not quite as disastrous as it usually is
+                 * because !cpu_active at this point, which means load-balance
+                 * will not interfere. Also, stop-machine.
+                 */
+                lockdep_unpin_lock(&rq->lock);
+                raw_spin_unlock(&rq->lock);
+                raw_spin_lock(&next->pi_lock);
+                raw_spin_lock(&rq->lock);
+
+                /*
+                 * Since we're inside stop-machine, _nothing_ should have
+                 * changed the task, WARN if weird stuff happened, because in
+                 * that case the above rq->lock drop is a fail too.
+                 */
+                if (WARN_ON(task_rq(next) != rq || !task_on_rq_queued(next))) {
+                        raw_spin_unlock(&next->pi_lock);
+                        continue;
+                }
+
                 /* Find suitable destination for @next, with force if needed. */
                 dest_cpu = select_fallback_rq(dead_rq->cpu, next);
 
-                lockdep_unpin_lock(&rq->lock);
                 rq = __migrate_task(rq, next, dest_cpu);
                 if (rq != dead_rq) {
                         raw_spin_unlock(&rq->lock);
                         rq = dead_rq;
                         raw_spin_lock(&rq->lock);
                 }
+                raw_spin_unlock(&next->pi_lock);
         }
 
         rq->stop = stop;