From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=170.10.133.124 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794240580; b=yBMioTvuiqX1jJWxyPmWntDd4DUScB2cC7OWzQomhT740IfRi8uFpMc5E8ZdzbVy8pgB jbb00ijkpSyXzTAguPj+6dJ6mBvR2DNQ/MpVBhqJ8Ap3mVKH/1c71/ZrkG+bmfJjmAiWg ZjD/KTql39OriDdf7TR+ErSXBY5ZOr98AxeGgLAdd/UoShv2mQBhnRizPnJKzAIDfIrnY oZGJc++xQ90If/Krl/adRrY0mdl4tMwdjSHOFVGvt21z0n5GMri+KUg5jKZmIc9KCm5yd jPEAo0g3oFUIFyKoOppPDKREZQhxDpkjBxVdaJR74erIMIGIzpq6hUgy1568l53FAxQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794240580; h=DMARC-Filter:DKIM-Signature:Received:X-MC-Unique: X-Mimecast-MFC-AGG-ID:Received:Received:From:To:Cc:Subject:Date: Message-ID:In-Reply-To:References:MIME-Version: Content-Transfer-Encoding:X-Scanned-By; bh=tvD4TMtCJkUt7Zh1imSbDDpg26XkeYYGU9jaHZWXuvw=; b=RL3Nio7j66EjOISo6TfqQdBWv4UHRzXTEHZLEwWPMwMxi1U10vt7os7Ze+a+ImyZ/Ivo U0+ytYy0rhwoJp94/6dzF8INmxWDNGw9RhkxcPlBuKNskg8q/6l/ULZpddPwcnqZtyIC9 OAYdqrg2FivH9kgVhGk20E0QC3FJ7myWujbQo0cB/yEFy3oJLCk+aH4NnnMmbTJN6TpBq 03FcdjW2ppKZfAANa44gmtS2/0ZHBFwFQhPFXiUOEdjHdfsezseNUSDXazSttEZNU9cuR opqRkxJSzgkY2zk97ycvzhmRDdMWO1DPML4HHg+c0Dlcb8ZcdDgRqbK5mg/xPmixmow== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=MaXXfYTH; arc=none smtp.remote-ip=170.10.133.124 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C434C606EE8B for ; Mon, 9 Nov 2026 16:09:39 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org C434C606EE8B Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=MaXXfYTH DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1794240578; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=tvD4TMtCJkUt7Zh1imSbDDpg26XkeYYGU9jaHZWXuvw=; b=MaXXfYTHnISsCZtYOF3dS5nNMWckrUMv74vXTEkDg6GIVO6+o1f0i6RVB9HN2uySlmBTGa zmbLqzG6F4CC8ysW4Y2E0y5uEIastO/HBz2/EUs+qGYt/Ul6akk6M0OHVNSJxt+kZdkr8i /vgEOR7ZaI95x/c6gPKWoWWatoZeDNY= Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-630-6vCoMHaPNiqaccLSxybm8A-1; Mon, 09 Nov 2026 11:09:35 -0500 X-MC-Unique: 6vCoMHaPNiqaccLSxybm8A-1 X-Mimecast-MFC-AGG-ID: 6vCoMHaPNiqaccLSxybm8A_1794240573 Received: from mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.95]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 4D83D1955D42; Mon, 9 Nov 2026 16:09:33 +0000 (UTC) Received: from llong-thinkpadp16vgen1.redhat.corp (headnet04.pony-001.prod.iad2.dc.redhat.com [10.2.32.116]) by mx-prod-int-10.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id ACABE7E2; Mon, 9 Nov 2026 16:09:31 +0000 (UTC) From: Waiman Long To: Ridong Chen , Tejun Heo , Johannes Weiner , =?UTF-8?q?Michal=20Koutn=C3=BD?= , Shuah Khan Cc: cgroups@vger.kernel.org, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, Guopeng Zhang , Waiman Long , Sashiko Subject: [PATCH 3/5] cgroup/cpuset: Protect current->mems_allowed read in cpuset_fork() Date: Mon, 9 Nov 2026 11:09:10 -0500 Message-ID: <20261109160912.1369897-4-longman@redhat.com> In-Reply-To: <20261109160912.1369897-1-longman@redhat.com> References: <20261109160912.1369897-1-longman@redhat.com> X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Scanned-By: MIMEDefang 3.6 on 10.30.177.95 Reading mems_allowed of the current task outside of cpuset_mutex critical section should be protected by using mems_allowed_seq seqlock as the nodemask can be updated concurrently leading to a torn read. Such protection is currently not implemented in cpuset_fork() for the !CLONE_INTO_CGROUP case. As a result, the child task may inherit an empty or corrupted mems_allowed nodemask. This violates NUMA memory policy constraints and causes subsequent page allocations to unconditionally fail, potentially leading to crashes or spurious OOM killer invocations for the child task. Fix that by using a read_mems_allowed_begin/read_mems_allowed_retry() loop to protect the mems_allowed read. Fixes: 06f4e9489891 ("cpuset: make sure new tasks conform to the current config of the cpuset") Reported-by: Sashiko Link: https://sashiko.dev/#/bug/linux-601100b4-fa77-45fd-99f9-bfbd4385201f Signed-off-by: Waiman Long --- kernel/cgroup/cpuset.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c index e8169b739454..1f25f27e0e9b 100644 --- a/kernel/cgroup/cpuset.c +++ b/kernel/cgroup/cpuset.c @@ -3864,11 +3864,20 @@ static void cpuset_fork(struct task_struct *task) rcu_read_unlock(); if (cs == oldcs) { + unsigned int seq; + if (cs == &top_cpuset) return; set_cpus_allowed_ptr(task, current->cpus_ptr); - task->mems_allowed = current->mems_allowed; + /* + * A cpuset.mems update can update current->mems_allowed + * concurrently, so retry it again if it really happens. + */ + do { + seq = read_mems_allowed_begin(); + task->mems_allowed = current->mems_allowed; + } while (read_mems_allowed_retry(seq)); return; } -- 2.56.0