* [PATCH] cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode()
@ 2026-09-30 1:28 Waiman Long
2026-09-30 1:57 ` Ridong Chen
0 siblings, 1 reply; 3+ messages in thread
From: Waiman Long @ 2026-09-30 1:28 UTC (permalink / raw)
To: Ridong Chen, Tejun Heo, Johannes Weiner, Michal Koutný
Cc: cgroups, linux-kernel, Andrea Righi, Waiman Long
After seeing the patch [1] to guard is_in_v2_mode() with RCU, it makes
me realize that is_in_v2_mode() may be called in a context where a new
cgroup filesystem is being rebound with stale cpuset_cgrp_subsys.root
pointer. Avoid this potential UaF situation by adding a new cpuset_v2_mode
flag which is set when the cpuset_v2_mode mount option is used. This
flag is written into only when cpuset_bind() is being called with a
stable cpuset_cgrp_subsys.root value. The is_in_v2_mode() helper is
modified to read the new cpuset_v2_mode flag instead of accessing
cpuset_cgrp_subsys.root directly.
[1] https://lore.kernel.org/lkml/20260929084124.626693-2-arighi@nvidia.com
Fixes: b8d1b8ee93df ("cpuset: Allow v2 behavior in v1 cgroup")
Signed-off-by: Waiman Long <longman@redhat.com>
---
kernel/cgroup/cpuset.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
index 19661df6244f..266ce17d1af0 100644
--- a/kernel/cgroup/cpuset.c
+++ b/kernel/cgroup/cpuset.c
@@ -147,6 +147,11 @@ static cpumask_var_t subpartitions_cpus; /* RWCS */
*/
static cpumask_var_t isolated_cpus; /* CSCB */
+/*
+ * Set if "cpuset_v2_mode" mount option is used
+ */
+static bool cpuset_v2_mode; /* Unprotected */
+
/*
* Set if housekeeping cpumasks are to be updated.
*/
@@ -439,8 +444,7 @@ static inline bool cpuset_v2(void)
*/
static inline bool is_in_v2_mode(void)
{
- return cpuset_v2() ||
- (cpuset_cgrp_subsys.root->flags & CGRP_ROOT_CPUSET_V2_MODE);
+ return cpuset_v2() || READ_ONCE(cpuset_v2_mode);
}
/**
@@ -3664,6 +3668,8 @@ static void cpuset_bind(struct cgroup_subsys_state *root_css)
mutex_lock(&cpuset_mutex);
spin_lock_irq(&callback_lock);
+ WRITE_ONCE(cpuset_v2_mode,
+ !!(cpuset_cgrp_subsys.root->flags & CGRP_ROOT_CPUSET_V2_MODE));
if (is_in_v2_mode()) {
cpumask_copy(top_cpuset.cpus_allowed, cpu_possible_mask);
cpumask_copy(top_cpuset.effective_xcpus, cpu_possible_mask);
--
2.55.0
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode()
2026-09-30 1:28 [PATCH] cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode() Waiman Long
@ 2026-09-30 1:57 ` Ridong Chen
2026-09-30 2:34 ` Waiman Long
0 siblings, 1 reply; 3+ messages in thread
From: Ridong Chen @ 2026-09-30 1:57 UTC (permalink / raw)
To: Waiman Long, Tejun Heo, Johannes Weiner, Michal Koutný
Cc: cgroups, linux-kernel, Andrea Righi
On 9/30/2026 9:28 AM, Waiman Long wrote:
> After seeing the patch [1] to guard is_in_v2_mode() with RCU, it makes
> me realize that is_in_v2_mode() may be called in a context where a new
> cgroup filesystem is being rebound with stale cpuset_cgrp_subsys.root
> pointer. Avoid this potential UaF situation by adding a new cpuset_v2_mode
> flag which is set when the cpuset_v2_mode mount option is used. This
> flag is written into only when cpuset_bind() is being called with a
> stable cpuset_cgrp_subsys.root value. The is_in_v2_mode() helper is
> modified to read the new cpuset_v2_mode flag instead of accessing
> cpuset_cgrp_subsys.root directly.
>
> [1] https://lore.kernel.org/lkml/20260929084124.626693-2-arighi@nvidia.com
>
> Fixes: b8d1b8ee93df ("cpuset: Allow v2 behavior in v1 cgroup")
> Signed-off-by: Waiman Long <longman@redhat.com>
> ---
> kernel/cgroup/cpuset.c | 10 ++++++++--
> 1 file changed, 8 insertions(+), 2 deletions(-)
>
> diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
> index 19661df6244f..266ce17d1af0 100644
> --- a/kernel/cgroup/cpuset.c
> +++ b/kernel/cgroup/cpuset.c
> @@ -147,6 +147,11 @@ static cpumask_var_t subpartitions_cpus; /* RWCS */
> */
> static cpumask_var_t isolated_cpus; /* CSCB */
>
> +/*
> + * Set if "cpuset_v2_mode" mount option is used
> + */
> +static bool cpuset_v2_mode; /* Unprotected */
> +
Nit.
`Unprotected` is wired here, will it be better with:
/* Cached at bind time; accessed via {READ,WRITE}_ONCE */
> /*
> * Set if housekeeping cpumasks are to be updated.
> */
> @@ -439,8 +444,7 @@ static inline bool cpuset_v2(void)
> */
> static inline bool is_in_v2_mode(void)
> {
> - return cpuset_v2() ||
> - (cpuset_cgrp_subsys.root->flags & CGRP_ROOT_CPUSET_V2_MODE);
> + return cpuset_v2() || READ_ONCE(cpuset_v2_mode);
> }
>
> /**
> @@ -3664,6 +3668,8 @@ static void cpuset_bind(struct cgroup_subsys_state *root_css)
> mutex_lock(&cpuset_mutex);
> spin_lock_irq(&callback_lock);
>
> + WRITE_ONCE(cpuset_v2_mode,
> + !!(cpuset_cgrp_subsys.root->flags & CGRP_ROOT_CPUSET_V2_MODE));
> if (is_in_v2_mode()) {
> cpumask_copy(top_cpuset.cpus_allowed, cpu_possible_mask);
> cpumask_copy(top_cpuset.effective_xcpus, cpu_possible_mask);
Reviewed-by: Ridong Chen <ridong.chen@linux.dev>
Thanks.
--
Best regards
Ridong
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode()
2026-09-30 1:57 ` Ridong Chen
@ 2026-09-30 2:34 ` Waiman Long
0 siblings, 0 replies; 3+ messages in thread
From: Waiman Long @ 2026-09-30 2:34 UTC (permalink / raw)
To: Ridong Chen, Tejun Heo, Johannes Weiner, Michal Koutný
Cc: cgroups, linux-kernel, Andrea Righi
On 9/29/26 9:57 PM, Ridong Chen wrote:
>
>
> On 9/30/2026 9:28 AM, Waiman Long wrote:
>> After seeing the patch [1] to guard is_in_v2_mode() with RCU, it makes
>> me realize that is_in_v2_mode() may be called in a context where a new
>> cgroup filesystem is being rebound with stale cpuset_cgrp_subsys.root
>> pointer. Avoid this potential UaF situation by adding a new
>> cpuset_v2_mode
>> flag which is set when the cpuset_v2_mode mount option is used. This
>> flag is written into only when cpuset_bind() is being called with a
>> stable cpuset_cgrp_subsys.root value. The is_in_v2_mode() helper is
>> modified to read the new cpuset_v2_mode flag instead of accessing
>> cpuset_cgrp_subsys.root directly.
>>
>> [1]
>> https://lore.kernel.org/lkml/20260929084124.626693-2-arighi@nvidia.com
>>
>> Fixes: b8d1b8ee93df ("cpuset: Allow v2 behavior in v1 cgroup")
>> Signed-off-by: Waiman Long <longman@redhat.com>
>> ---
>> kernel/cgroup/cpuset.c | 10 ++++++++--
>> 1 file changed, 8 insertions(+), 2 deletions(-)
>>
>> diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
>> index 19661df6244f..266ce17d1af0 100644
>> --- a/kernel/cgroup/cpuset.c
>> +++ b/kernel/cgroup/cpuset.c
>> @@ -147,6 +147,11 @@ static cpumask_var_t subpartitions_cpus; /*
>> RWCS */
>> */
>> static cpumask_var_t isolated_cpus; /* CSCB */
>> +/*
>> + * Set if "cpuset_v2_mode" mount option is used
>> + */
>> +static bool cpuset_v2_mode; /* Unprotected */
>> +
>
> Nit.
>
> `Unprotected` is wired here, will it be better with:
>
> /* Cached at bind time; accessed via {READ,WRITE}_ONCE */
Unprotected just means it is not protected by any lock. I should have
said "not lock protected".
>
>> /*
>> * Set if housekeeping cpumasks are to be updated.
>> */
>> @@ -439,8 +444,7 @@ static inline bool cpuset_v2(void)
>> */
>> static inline bool is_in_v2_mode(void)
>> {
>> - return cpuset_v2() ||
>> - (cpuset_cgrp_subsys.root->flags & CGRP_ROOT_CPUSET_V2_MODE);
>> + return cpuset_v2() || READ_ONCE(cpuset_v2_mode);
>> }
>> /**
>> @@ -3664,6 +3668,8 @@ static void cpuset_bind(struct
>> cgroup_subsys_state *root_css)
>> mutex_lock(&cpuset_mutex);
>> spin_lock_irq(&callback_lock);
>> + WRITE_ONCE(cpuset_v2_mode,
>> + !!(cpuset_cgrp_subsys.root->flags &
>> CGRP_ROOT_CPUSET_V2_MODE));
>> if (is_in_v2_mode()) {
>> cpumask_copy(top_cpuset.cpus_allowed, cpu_possible_mask);
>> cpumask_copy(top_cpuset.effective_xcpus, cpu_possible_mask);
>
>
> Reviewed-by: Ridong Chen <ridong.chen@linux.dev>
> Thanks.
>
Thanks for the review.
Cheers,
Longman
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-09-30 2:35 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-30 1:28 [PATCH] cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode() Waiman Long
2026-09-30 1:57 ` Ridong Chen
2026-09-30 2:34 ` Waiman Long
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®