[PATCH v4 0/3] cgroup/cpuset: fix exclusive CPU conflict checks for local and remote partitions

[PATCH v4 0/3] cgroup/cpuset: fix exclusive CPU conflict checks for local and remote partitions

[Hui Peng]

This series fixes three exclusive CPU validation gaps across local and
remote partitions in kernel/cgroup/cpuset.c and adds corresponding
regression tests to tools/testing/selftests/cgroup/test_cpuset_prs.sh:

1. Patch 1/3 ("cgroup/cpuset: return PERR_NOCPUS in
   remote_partition_enable() on subpartitions_cpus conflict"):
   Restores the subpartitions_cpus conflict error check in
   remote_partition_enable() (returning PERR_NOCPUS to match
   remote_cpus_update()) so a remote partition cannot be enabled
   underneath an ancestor local partition via a non-partition
   intermediate cgroup.

2. Patch 2/3 ("cgroup/cpuset: prevent activating local partition over
   remote one"):
   Checks trialcs->exclusive_cpus against subpartitions_cpus in
   validate_partition() when !is_partition_valid(cs) so an initially
   invalid top-level partition cannot later transition to a valid local
   partition over an active remote partition via cpuset.cpus /
   cpuset.cpus.exclusive updates.

3. Patch 3/3 ("cgroup/cpuset: check sibling effective_xcpus in
   cpus_excl_conflict()"):
   Falls back to sibling->effective_xcpus in cpus_excl_conflict() when
   sibling->exclusive_cpus is empty so a sibling cgroup cannot claim
   cpuset.cpus.exclusive over a valid local partition's implicit
   exclusive CPUs.

Changes in v4:
- Send as a standalone series with a cover letter (0/3) instead of
  replying in-thread to the previous version, as requested by Ridong
  Chen and Waiman Long.
- Restore the exact v2 diff and commit description for patch 1/3
  (which was accidentally corrupted when splitting v2 into 3 patches in
  v3), fixing git apply against mainline.
- Make the test_cpuset_prs.sh test case in patch 2/3 independent of the
  system CPU count (using X2-3 / CX2-3:P2 / P1:CX1-3 instead of
  CX0-7:P1), as pointed out by Waiman Long.

Changes in v3:
- Split patch 2/2 from v2 into patch 2/3 (validate_partition(),
  Fixes: 6da580ec656a) and patch 3/3 (cpus_excl_conflict(),
  Fixes: 2a3602030d80), as pointed out by Guopeng Zhang.
- Add Assisted-by: LLM tag.

Changes in v2:
- Split the remote_partition_enable() fix into patch 1/2 and return
  PERR_NOCPUS instead of PERR_INVCPUS to match remote_cpus_update(), as
  suggested by Guopeng Zhang.
- Add step-by-step reproducer and test_cpuset_prs.sh regression tests,
  as requested by Ridong Chen.

Hui Peng (3):
  cgroup/cpuset: return PERR_NOCPUS in remote_partition_enable() on subpartitions_cpus conflict
  cgroup/cpuset: prevent activating local partition over remote one
  cgroup/cpuset: check sibling effective_xcpus in cpus_excl_conflict()

 kernel/cgroup/cpuset.c                            | 12 ++++++++++--
 tools/testing/selftests/cgroup/test_cpuset_prs.sh |  5 +++++
 2 files changed, 15 insertions(+), 2 deletions(-)

-- 
2.49.0

[PATCH v4 1/3] cgroup/cpuset: return PERR_NOCPUS in remote_partition_enable() on subpartitions_cpus conflict

[Hui Peng]

When a remote partition is created underneath an existing local partition
via a non-partition (PRS_MEMBER) intermediate cgroup, update_prstate() sees
parent->partition_root_state == PRS_MEMBER and calls
remote_partition_enable().

Commit 86888c7bd117 ("cgroup/cpuset: Add warnings to catch inconsistency
in exclusive CPUs") replaced the cpumask_intersects(tmp->new_cpus,
subpartitions_cpus) error check in remote_partition_enable() with
WARN_ON_ONCE(). As a result, remote_partition_enable() emits a warning
and proceeds to enable the remote partition on CPUs that are already
owned by the ancestor local partition in subpartitions_cpus.

This can be reproduced on Linux 7.3.0-rc3 with:

  mkdir -p /tmp/cg1
  mount -t cgroup2 none /tmp/cg1
  echo "+cpuset" > /tmp/cg1/cgroup.subtree_control

  mkdir /tmp/cg1/A
  echo 1 > /tmp/cg1/A/cpuset.cpus
  echo 1 > /tmp/cg1/A/cpuset.cpus.exclusive
  echo root > /tmp/cg1/A/cpuset.cpus.partition
  echo "+cpuset" > /tmp/cg1/A/cgroup.subtree_control

  mkdir /tmp/cg1/A/B
  echo 1 > /tmp/cg1/A/B/cpuset.cpus
  echo 1 > /tmp/cg1/A/B/cpuset.cpus.exclusive
  echo "+cpuset" > /tmp/cg1/A/B/cgroup.subtree_control

  mkdir /tmp/cg1/A/B/D
  echo 1 > /tmp/cg1/A/B/D/cpuset.cpus
  echo 1 > /tmp/cg1/A/B/D/cpuset.cpus.exclusive
  echo root > /tmp/cg1/A/B/D/cpuset.cpus.partition

which triggers:

  WARNING: kernel/cgroup/cpuset.c:1594 at remote_partition_enable+0x1c1/0x300

and leaves both /tmp/cg1/A and /tmp/cg1/A/B/D as active root partitions
claiming exclusive CPU 1.

Fix this by returning PERR_NOCPUS when tmp->new_cpus intersects
subpartitions_cpus in remote_partition_enable(), matching the error code
used by remote_cpus_update() for the same subpartitions_cpus conflict, and
add a regression test case to
tools/testing/selftests/cgroup/test_cpuset_prs.sh.

Tested in QEMU on Linux 7.3.0-rc3 using the reproducer above and
tools/testing/selftests/cgroup/test_cpuset_prs.sh.

Fixes: 86888c7bd117 ("cgroup/cpuset: Add warnings to catch inconsistency in exclusive CPUs")
Suggested-by: Guopeng Zhang <guopeng.zhang@linux.dev>
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
---
 kernel/cgroup/cpuset.c                            | 3 ++-
 tools/testing/selftests/cgroup/test_cpuset_prs.sh | 2 ++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
index 2538faac9aba..7381fa8502e7 100644
--- a/kernel/cgroup/cpuset.c
+++ b/kernel/cgroup/cpuset.c
@@ -1591,10 +1591,11 @@ static int remote_partition_enable(struct cpuset *cs, int new_prs,
 	 * above it or remote partition root underneath it is not allowed.
 	 */
 	compute_excpus(cs, tmp->new_cpus);
-	WARN_ON_ONCE(cpumask_intersects(tmp->new_cpus, subpartitions_cpus));
 	if (!cpumask_intersects(tmp->new_cpus, cpu_active_mask) ||
 	    cpumask_subset(top_cpuset.effective_cpus, tmp->new_cpus))
 		return PERR_INVCPUS;
+	if (cpumask_intersects(tmp->new_cpus, subpartitions_cpus))
+		return PERR_NOCPUS;
 	if (((new_prs == PRS_ISOLATED) &&
 	     !isolated_cpus_can_update(tmp->new_cpus, NULL)) ||
 	    prstate_housekeeping_conflict(new_prs, tmp->new_cpus))
diff --git a/tools/testing/selftests/cgroup/test_cpuset_prs.sh b/tools/testing/selftests/cgroup/test_cpuset_prs.sh
index 3f7e81709365..b732078bf319 100755
--- a/tools/testing/selftests/cgroup/test_cpuset_prs.sh
+++ b/tools/testing/selftests/cgroup/test_cpuset_prs.sh
@@ -298,6 +298,8 @@ TEST_MATRIX=(
 	" C0-4:X2-4 C1-4:X2-4:P2 C2-4:X4:P1 \
 				   .      .      .      X1      .    0 A1:0-1|A2:2-4|A3:2-4 \
 								       A1:P0|A2:P2|A3:P-1 2-4"
+	" CX1-3:P1 CX1-3  CX1-3    .      .      .      P1      .    0 A1:1-3|A2:1-3|A3:1-3 \
+								       A1:P1|A2:P0|A3:P-1"
 
 	# Remote partition offline tests
 	"   C0-3    C1-3  C2-3     .    X2-3   X2-3 X2-3:P2:O2=0 .   0 A1:0-1|A2:1|A3:3 A1:P0|A3:P2 2-3"
-- 
2.49.0

[PATCH v4 2/3] cgroup/cpuset: prevent activating local partition over remote one

[Hui Peng]

Commit 6da580ec656a ("cgroup/cpuset: Don't allow creation of local
partition over a remote one") added a check in update_prstate() to reject
creating a top-level local partition whose cs->exclusive_cpus intersects
subpartitions_cpus.

However, if a top-level cgroup A1 has a child A1/A2 enabled as a remote
partition on a subset of its exclusive CPUs (X2-3 on A1, CX2-3:P2 on
A1/A2), and A1 is then set to "root" (P1, becoming "root invalid" via
update_prstate() because its exclusive CPUs intersect subpartitions_cpus)
followed by expanding its CPUs to include additional non-remote CPUs
(CX1-3), update_cpumask() / update_exclusive_cpumask() calls
validate_partition() without going through update_prstate(). Because
validate_partition() does not check trialcs->exclusive_cpus against
subpartitions_cpus, A1 transitions from "root invalid" to a valid local
partition over the existing remote partition A1/A2 and triggers:

  WARNING: kernel/cgroup/cpuset.c:1943 at update_parent_effective_cpumask+0x189b/0x1fd0

Check trialcs->exclusive_cpus against subpartitions_cpus in
validate_partition() when !is_partition_valid(cs), and add a regression
test case to tools/testing/selftests/cgroup/test_cpuset_prs.sh.

Tested in QEMU on Linux 7.3.0-rc3 using
tools/testing/selftests/cgroup/test_cpuset_prs.sh.

Fixes: 6da580ec656a ("cgroup/cpuset: Don't allow creation of local partition over a remote one")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
---
 kernel/cgroup/cpuset.c                            | 4 ++++
 tools/testing/selftests/cgroup/test_cpuset_prs.sh | 2 ++
 2 files changed, 6 insertions(+)

diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
index 7381fa8502e7..7c5b4a8f1f3a 100644
--- a/kernel/cgroup/cpuset.c
+++ b/kernel/cgroup/cpuset.c
@@ -2415,6 +2415,10 @@ static enum prs_errcode validate_partition(struct cpuset *cs, struct cpuset *tri
 	if (cpumask_empty(trialcs->effective_xcpus))
 		return PERR_INVCPUS;
 
+	if ((parent == &top_cpuset) && !is_partition_valid(cs) &&
+	    cpumask_intersects(trialcs->exclusive_cpus, subpartitions_cpus))
+		return PERR_REMOTE;
+
 	if (prstate_housekeeping_conflict(trialcs->partition_root_state,
 					  trialcs->effective_xcpus))
 		return PERR_HKEEPING;
diff --git a/tools/testing/selftests/cgroup/test_cpuset_prs.sh b/tools/testing/selftests/cgroup/test_cpuset_prs.sh
index b732078bf319..4a451350ad84 100755
--- a/tools/testing/selftests/cgroup/test_cpuset_prs.sh
+++ b/tools/testing/selftests/cgroup/test_cpuset_prs.sh
@@ -321,6 +321,8 @@ TEST_MATRIX=(
 	" C1-3:P2  X4:P2    .      .      .    X3:P2    .      .     0 A1:1-2|XA1:1-3|A2:3:XA2:3 A1:P2|A2:P2 1-3"
 	" C0-3:P2    .      .    C4-6   C0-4     .      .      .     0 A1:0-4|B1:5-6 A1:P2|B1:P0"
 	" C0-3:P2    .      .    C4-6 C0-4:C0-3  .      .      .     0 A1:0-3|B1:4-6 A1:P2|B1:P0 0-3"
+	"   X2-3  CX2-3:P2  .      .  P1:CX1-3   .      .      .     0 A1:1|A2:2-3|XA2:2-3 \
+								       A1:P-1|A2:P2 2-3"
 
 	# Local partition invalidation tests
 	" C0-3:X1-3:P2 C1-3:X2-3:P2 C2-3:X3:P2 \
-- 
2.49.0

[PATCH v4 3/3] cgroup/cpuset: check sibling effective_xcpus in cpus_excl_conflict()

[Hui Peng]

In cpus_excl_conflict(), when a valid local partition A1 uses implicit
exclusive CPUs (cpuset.cpus set without cpuset.cpus.exclusive, so
sibling->exclusive_cpus is empty while sibling->effective_xcpus is
populated), a sibling cgroup B1 can still set cpuset.cpus.exclusive on
the same CPUs because cpus_excl_conflict() only checks
sibling->exclusive_cpus.

Fall back to sibling->effective_xcpus in cpus_excl_conflict() when
sibling->exclusive_cpus is empty, and add a regression test case to
tools/testing/selftests/cgroup/test_cpuset_prs.sh.

Tested in QEMU on Linux 7.3.0-rc3 using
tools/testing/selftests/cgroup/test_cpuset_prs.sh.

Fixes: 2a3602030d80 ("cgroup/cpuset: Don't invalidate sibling partitions on cpuset.cpus conflict")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
---
 kernel/cgroup/cpuset.c                            | 5 ++++-
 tools/testing/selftests/cgroup/test_cpuset_prs.sh | 1 +
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
index 7c5b4a8f1f3a..f46a51f07938 100644
--- a/kernel/cgroup/cpuset.c
+++ b/kernel/cgroup/cpuset.c
@@ -713,7 +713,10 @@ static inline bool cpus_excl_conflict(struct cpuset *trial, struct cpuset *sibli
 		return true;
 
 	/* Exclusive_cpus cannot intersect */
-	return cpumask_intersects(trial->exclusive_cpus, sibling->exclusive_cpus);
+	return cpumask_intersects(trial->exclusive_cpus,
+				  cpumask_empty(sibling->exclusive_cpus)
+				  ? sibling->effective_xcpus
+				  : sibling->exclusive_cpus);
 }
 
 static inline bool mems_excl_conflict(struct cpuset *cs1, struct cpuset *cs2)
diff --git a/tools/testing/selftests/cgroup/test_cpuset_prs.sh b/tools/testing/selftests/cgroup/test_cpuset_prs.sh
index f4d1822d4e21..f62155cf6162 100755
--- a/tools/testing/selftests/cgroup/test_cpuset_prs.sh
+++ b/tools/testing/selftests/cgroup/test_cpuset_prs.sh
@@ -445,6 +445,7 @@ TEST_MATRIX=(
 
 	# Changes to cpuset.cpus.exclusive that violate exclusivity rule is rejected
 	"   C0-3     .      .    C4-5   X0-3     .      .     X3-5   1 A1:0-3|B1:4-5"
+	"  C0-3:P1   .      .    C4-5     .      .      .     X3-5   1 A1:0-3|B1:4-5 A1:P1|B1:P0"
 
 	# cpuset.cpus.exclusive cannot be set to a superset of sibling's cpuset.cpus
 	"   C0-3     .      .    C4-5   X3-5     .      .      .     1 A1:0-3|B1:4-5"
-- 
2.49.0

Re: [PATCH v4 1/3] cgroup/cpuset: return PERR_NOCPUS in remote_partition_enable() on subpartitions_cpus conflict

[Waiman Long]

On 9/24/26 12:27 AM, Hui Peng wrote:
> When a remote partition is created underneath an existing local partition
> via a non-partition (PRS_MEMBER) intermediate cgroup, update_prstate() sees
> parent->partition_root_state == PRS_MEMBER and calls
> remote_partition_enable().
>
> Commit 86888c7bd117 ("cgroup/cpuset: Add warnings to catch inconsistency
> in exclusive CPUs") replaced the cpumask_intersects(tmp->new_cpus,
> subpartitions_cpus) error check in remote_partition_enable() with
> WARN_ON_ONCE(). As a result, remote_partition_enable() emits a warning
> and proceeds to enable the remote partition on CPUs that are already
> owned by the ancestor local partition in subpartitions_cpus.
>
> This can be reproduced on Linux 7.3.0-rc3 with:
>
>    mkdir -p /tmp/cg1
>    mount -t cgroup2 none /tmp/cg1
>    echo "+cpuset" > /tmp/cg1/cgroup.subtree_control
>
>    mkdir /tmp/cg1/A
>    echo 1 > /tmp/cg1/A/cpuset.cpus
>    echo 1 > /tmp/cg1/A/cpuset.cpus.exclusive
>    echo root > /tmp/cg1/A/cpuset.cpus.partition
>    echo "+cpuset" > /tmp/cg1/A/cgroup.subtree_control
>
>    mkdir /tmp/cg1/A/B
>    echo 1 > /tmp/cg1/A/B/cpuset.cpus
>    echo 1 > /tmp/cg1/A/B/cpuset.cpus.exclusive
>    echo "+cpuset" > /tmp/cg1/A/B/cgroup.subtree_control
>
>    mkdir /tmp/cg1/A/B/D
>    echo 1 > /tmp/cg1/A/B/D/cpuset.cpus
>    echo 1 > /tmp/cg1/A/B/D/cpuset.cpus.exclusive
>    echo root > /tmp/cg1/A/B/D/cpuset.cpus.partition
>
> which triggers:
>
>    WARNING: kernel/cgroup/cpuset.c:1594 at remote_partition_enable+0x1c1/0x300
>
> and leaves both /tmp/cg1/A and /tmp/cg1/A/B/D as active root partitions
> claiming exclusive CPU 1.
>
> Fix this by returning PERR_NOCPUS when tmp->new_cpus intersects
> subpartitions_cpus in remote_partition_enable(), matching the error code
> used by remote_cpus_update() for the same subpartitions_cpus conflict, and
> add a regression test case to
> tools/testing/selftests/cgroup/test_cpuset_prs.sh.
>
> Tested in QEMU on Linux 7.3.0-rc3 using the reproducer above and
> tools/testing/selftests/cgroup/test_cpuset_prs.sh.
>
> Fixes: 86888c7bd117 ("cgroup/cpuset: Add warnings to catch inconsistency in exclusive CPUs"

Technically, this commit isn't  wrong as it does not expect that a 
remote partition can be created under a local partition. I will put the 
commit to be fixed as 181c8e091aae ("cgroup/cpuset: Introduce remote 
partition").

Other than that, it looks good to me.

Reviewed-by: Waiman Long <longman@redhat.com>

> Suggested-by: Guopeng Zhang <guopeng.zhang@linux.dev>
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Hui Peng <benquike@gmail.com>
> ---
>   kernel/cgroup/cpuset.c                            | 3 ++-
>   tools/testing/selftests/cgroup/test_cpuset_prs.sh | 2 ++
>   2 files changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
> index 2538faac9aba..7381fa8502e7 100644
> --- a/kernel/cgroup/cpuset.c
> +++ b/kernel/cgroup/cpuset.c
> @@ -1591,10 +1591,11 @@ static int remote_partition_enable(struct cpuset *cs, int new_prs,
>   	 * above it or remote partition root underneath it is not allowed.
>   	 */
>   	compute_excpus(cs, tmp->new_cpus);
> -	WARN_ON_ONCE(cpumask_intersects(tmp->new_cpus, subpartitions_cpus));
>   	if (!cpumask_intersects(tmp->new_cpus, cpu_active_mask) ||
>   	    cpumask_subset(top_cpuset.effective_cpus, tmp->new_cpus))
>   		return PERR_INVCPUS;
> +	if (cpumask_intersects(tmp->new_cpus, subpartitions_cpus))
> +		return PERR_NOCPUS;
>   	if (((new_prs == PRS_ISOLATED) &&
>   	     !isolated_cpus_can_update(tmp->new_cpus, NULL)) ||
>   	    prstate_housekeeping_conflict(new_prs, tmp->new_cpus))
> diff --git a/tools/testing/selftests/cgroup/test_cpuset_prs.sh b/tools/testing/selftests/cgroup/test_cpuset_prs.sh
> index 3f7e81709365..b732078bf319 100755
> --- a/tools/testing/selftests/cgroup/test_cpuset_prs.sh
> +++ b/tools/testing/selftests/cgroup/test_cpuset_prs.sh
> @@ -298,6 +298,8 @@ TEST_MATRIX=(
>   	" C0-4:X2-4 C1-4:X2-4:P2 C2-4:X4:P1 \
>   				   .      .      .      X1      .    0 A1:0-1|A2:2-4|A3:2-4 \
>   								       A1:P0|A2:P2|A3:P-1 2-4"
> +	" CX1-3:P1 CX1-3  CX1-3    .      .      .      P1      .    0 A1:1-3|A2:1-3|A3:1-3 \
> +								       A1:P1|A2:P0|A3:P-1"
>   
>   	# Remote partition offline tests
>   	"   C0-3    C1-3  C2-3     .    X2-3   X2-3 X2-3:P2:O2=0 .   0 A1:0-1|A2:1|A3:3 A1:P0|A3:P2 2-3"

Re: [PATCH v4 1/3] cgroup/cpuset: return PERR_NOCPUS in remote_partition_enable() on subpartitions_cpus conflict

[Tejun Heo]

Applied to cgroup/for-7.3-fixes with the subject capitalized and the
following tag added:

  Reviewed-by: Waiman Long <longman@redhat.com>

Waiman, I kept the original Fixes: tag. 181c8e091aae ("cgroup/cpuset:
Introduce remote partition") added the subpartitions_cpus intersection
check that rejected this configuration in remote_partition_enable(), and
the check stayed through v6.15. 86888c7bd117 ("cgroup/cpuset: Add
warnings to catch inconsistency in exclusive CPUs") turned it into a
WARN_ON_ONCE() and let the enable proceed, which made the overlap
reachable. Tagging the remote partition commit would also send the fix
to stable trees older than v6.16, which don't have the bug. Do you
agree?

Thanks.

--
tejun