[BUG] general protection fault in cpuset_cpus_allowed

[BUG] general protection fault in cpuset_cpus_allowed

[Farhad Alemi]

Hello,

As part of the kernel research at ASU's SEFCOM
lab, we hit the crash below. Crash reports can be found here:

  https://github.com/farhad-alemi/public_bug_reports/tree/main/166-general-protection-fault-in-cpuset-cpus-allowed/

  Oops: general protection fault, probably for non-canonical address
0xdffffc000000001d: 0000 [#1] SMP KASAN NOPTI
  KASAN: null-ptr-deref in range [0x00000000000000e8-0x00000000000000ef]
  RIP: 0010:bitmap_intersects include/linux/bitmap.h:440 [inline]
  RIP: 0010:cpumask_intersects include/linux/cpumask.h:822 [inline]
  RIP: 0010:guarantee_active_cpus kernel/cgroup/cpuset.c:481 [inline]
  RIP: 0010:__cpuset_cpus_allowed_locked kernel/cgroup/cpuset.c:4022 [inline]
  RIP: 0010:cpuset_cpus_allowed+0x14a/0x2f0 kernel/cgroup/cpuset.c:4071
  Call Trace:
   cpuset_cpus_allowed+0x14a/0x2f0 kernel/cgroup/cpuset.c:4071
   __sched_setaffinity+0x98/0x3c0 kernel/sched/syscalls.c:1149
   sched_setaffinity+0x341/0x4a0 kernel/sched/syscalls.c:1237
   __x64_sys_sched_setaffinity+0x106/0x170 kernel/sched/syscalls.c:1262

A second capture reaches the identical fault -- same address, same KASAN range,
same RIP -- through cpuset_fork <- cgroup_post_fork <- copy_process <-
kernel_clone <- clone3, with the crashing task being systemd at PID 1.

Our reproducer.c is available upon request.

Happy to test a patch if that would help.

Regards,

Re: [BUG] general protection fault in cpuset_cpus_allowed

[Ridong Chen]

On 8/28/2026 1:43 PM, Farhad Alemi wrote:
> Hello,
> 
> As part of the kernel research at ASU's SEFCOM
> lab, we hit the crash below. Crash reports can be found here:
> 
>    https://github.com/farhad-alemi/public_bug_reports/tree/main/166-general-protection-fault-in-cpuset-cpus-allowed/
> 
>    Oops: general protection fault, probably for non-canonical address
> 0xdffffc000000001d: 0000 [#1] SMP KASAN NOPTI
>    KASAN: null-ptr-deref in range [0x00000000000000e8-0x00000000000000ef]
>    RIP: 0010:bitmap_intersects include/linux/bitmap.h:440 [inline]
>    RIP: 0010:cpumask_intersects include/linux/cpumask.h:822 [inline]
>    RIP: 0010:guarantee_active_cpus kernel/cgroup/cpuset.c:481 [inline]
>    RIP: 0010:__cpuset_cpus_allowed_locked kernel/cgroup/cpuset.c:4022 [inline]
>    RIP: 0010:cpuset_cpus_allowed+0x14a/0x2f0 kernel/cgroup/cpuset.c:4071
>    Call Trace:
>     cpuset_cpus_allowed+0x14a/0x2f0 kernel/cgroup/cpuset.c:4071
>     __sched_setaffinity+0x98/0x3c0 kernel/sched/syscalls.c:1149
>     sched_setaffinity+0x341/0x4a0 kernel/sched/syscalls.c:1237
>     __x64_sys_sched_setaffinity+0x106/0x170 kernel/sched/syscalls.c:1262
> 
> A second capture reaches the identical fault -- same address, same KASAN range,
> same RIP -- through cpuset_fork <- cgroup_post_fork <- copy_process <-
> kernel_clone <- clone3, with the crashing task being systemd at PID 1.
> 
> Our reproducer.c is available upon request.
> 

Thank you for the report.

Could you please share the reproducer.c with us?

> Happy to test a patch if that would help.
> 
> Regards,

-- 
Best regards
Ridong

Re: [BUG] general protection fault in cpuset_cpus_allowed

[Ridong Chen]

On 8/28/2026 5:21 PM, Ridong Chen wrote:
> 
> 
> On 8/28/2026 1:43 PM, Farhad Alemi wrote:
>> Hello,
>>
>> As part of the kernel research at ASU's SEFCOM
>> lab, we hit the crash below. Crash reports can be found here:
>>
>>    https://github.com/farhad-alemi/public_bug_reports/tree/main/166-general- 
>> protection-fault-in-cpuset-cpus-allowed/
>>
>>    Oops: general protection fault, probably for non-canonical address
>> 0xdffffc000000001d: 0000 [#1] SMP KASAN NOPTI
>>    KASAN: null-ptr-deref in range [0x00000000000000e8-0x00000000000000ef]
>>    RIP: 0010:bitmap_intersects include/linux/bitmap.h:440 [inline]
>>    RIP: 0010:cpumask_intersects include/linux/cpumask.h:822 [inline]
>>    RIP: 0010:guarantee_active_cpus kernel/cgroup/cpuset.c:481 [inline]
>>    RIP: 0010:__cpuset_cpus_allowed_locked kernel/cgroup/cpuset.c:4022 [inline]
>>    RIP: 0010:cpuset_cpus_allowed+0x14a/0x2f0 kernel/cgroup/cpuset.c:4071
>>    Call Trace:
>>     cpuset_cpus_allowed+0x14a/0x2f0 kernel/cgroup/cpuset.c:4071
>>     __sched_setaffinity+0x98/0x3c0 kernel/sched/syscalls.c:1149
>>     sched_setaffinity+0x341/0x4a0 kernel/sched/syscalls.c:1237
>>     __x64_sys_sched_setaffinity+0x106/0x170 kernel/sched/syscalls.c:1262
>>
>> A second capture reaches the identical fault -- same address, same KASAN range,
>> same RIP -- through cpuset_fork <- cgroup_post_fork <- copy_process <-
>> kernel_clone <- clone3, with the crashing task being systemd at PID 1.
>>
>> Our reproducer.c is available upon request.
>>
> 
> Thank you for the report.
> 
> Could you please share the reproducer.c with us?
> 

I suspect this might be caused by cs becoming NULL when cs = parent_cs(top_cpuset).

Having the reproducer would help me debug how this situation could occur.

```
static void guarantee_active_cpus(struct task_struct *tsk,
				  struct cpumask *pmask)
{
...
             while (!cpumask_intersects(cs->effective_cpus, pmask))
                     cs = parent_cs(cs);
...
}
```

>> Happy to test a patch if that would help.
>>
>> Regards,
> 

-- 
Best regards
Ridong

Re: [BUG] general protection fault in cpuset_cpus_allowed

[Waiman Long]

On 8/28/26 1:43 AM, Farhad Alemi wrote:
> Hello,
>
> As part of the kernel research at ASU's SEFCOM
> lab, we hit the crash below. Crash reports can be found here:
>
>    https://github.com/farhad-alemi/public_bug_reports/tree/main/166-general-protection-fault-in-cpuset-cpus-allowed/
>
>    Oops: general protection fault, probably for non-canonical address
> 0xdffffc000000001d: 0000 [#1] SMP KASAN NOPTI
>    KASAN: null-ptr-deref in range [0x00000000000000e8-0x00000000000000ef]
>    RIP: 0010:bitmap_intersects include/linux/bitmap.h:440 [inline]
>    RIP: 0010:cpumask_intersects include/linux/cpumask.h:822 [inline]
>    RIP: 0010:guarantee_active_cpus kernel/cgroup/cpuset.c:481 [inline]
>    RIP: 0010:__cpuset_cpus_allowed_locked kernel/cgroup/cpuset.c:4022 [inline]
>    RIP: 0010:cpuset_cpus_allowed+0x14a/0x2f0 kernel/cgroup/cpuset.c:4071
>    Call Trace:
>     cpuset_cpus_allowed+0x14a/0x2f0 kernel/cgroup/cpuset.c:4071
>     __sched_setaffinity+0x98/0x3c0 kernel/sched/syscalls.c:1149
>     sched_setaffinity+0x341/0x4a0 kernel/sched/syscalls.c:1237
>     __x64_sys_sched_setaffinity+0x106/0x170 kernel/sched/syscalls.c:1262
>
> A second capture reaches the identical fault -- same address, same KASAN range,
> same RIP -- through cpuset_fork <- cgroup_post_fork <- copy_process <-
> kernel_clone <- clone3, with the crashing task being systemd at PID 1.
>
> Our reproducer.c is available upon request.
>
> Happy to test a patch if that would help.

This null pointer dereference should only happen if you are racing 
sched_setaffinity() with cpu hotplug operation. Right?

Anyway, I have sent out a patch to hopefully address this bug. Could you 
try out the patch to see if it fixes the problem?

Thanks,
Longman