Re: [PATCH] cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode()

[Waiman Long <longman@redhat.com>]

On 9/29/26 9:57 PM, Ridong Chen wrote:
>
>
> On 9/30/2026 9:28 AM, Waiman Long wrote:
>> After seeing the patch [1] to guard is_in_v2_mode() with RCU, it makes
>> me realize that is_in_v2_mode() may be called in a context where a new
>> cgroup filesystem is being rebound with stale cpuset_cgrp_subsys.root
>> pointer. Avoid this potential UaF situation by adding a new 
>> cpuset_v2_mode
>> flag which is set when the cpuset_v2_mode mount option is used. This
>> flag is written into only when cpuset_bind() is being called with a
>> stable cpuset_cgrp_subsys.root value. The is_in_v2_mode() helper is
>> modified to read the new cpuset_v2_mode flag instead of accessing
>> cpuset_cgrp_subsys.root directly.
>>
>> [1] 
>> https://lore.kernel.org/lkml/20260929084124.626693-2-arighi@nvidia.com
>>
>> Fixes: b8d1b8ee93df ("cpuset: Allow v2 behavior in v1 cgroup")
>> Signed-off-by: Waiman Long <longman@redhat.com>
>> ---
>>   kernel/cgroup/cpuset.c | 10 ++++++++--
>>   1 file changed, 8 insertions(+), 2 deletions(-)
>>
>> diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
>> index 19661df6244f..266ce17d1af0 100644
>> --- a/kernel/cgroup/cpuset.c
>> +++ b/kernel/cgroup/cpuset.c
>> @@ -147,6 +147,11 @@ static cpumask_var_t subpartitions_cpus;    /* 
>> RWCS */
>>    */
>>   static cpumask_var_t    isolated_cpus;        /* CSCB */
>>   +/*
>> + * Set if "cpuset_v2_mode" mount option is used
>> + */
>> +static bool        cpuset_v2_mode;        /* Unprotected */
>> +
>
> Nit.
>
> `Unprotected` is wired here, will it be better with:
>
> /* Cached at bind time; accessed via {READ,WRITE}_ONCE */
Unprotected just means it is not protected by any lock. I should have 
said "not lock protected".
>
>>   /*
>>    * Set if housekeeping cpumasks are to be updated.
>>    */
>> @@ -439,8 +444,7 @@ static inline bool cpuset_v2(void)
>>    */
>>   static inline bool is_in_v2_mode(void)
>>   {
>> -    return cpuset_v2() ||
>> -          (cpuset_cgrp_subsys.root->flags & CGRP_ROOT_CPUSET_V2_MODE);
>> +    return cpuset_v2() || READ_ONCE(cpuset_v2_mode);
>>   }
>>     /**
>> @@ -3664,6 +3668,8 @@ static void cpuset_bind(struct 
>> cgroup_subsys_state *root_css)
>>       mutex_lock(&cpuset_mutex);
>>       spin_lock_irq(&callback_lock);
>>   +    WRITE_ONCE(cpuset_v2_mode,
>> +           !!(cpuset_cgrp_subsys.root->flags & 
>> CGRP_ROOT_CPUSET_V2_MODE));
>>       if (is_in_v2_mode()) {
>>           cpumask_copy(top_cpuset.cpus_allowed, cpu_possible_mask);
>>           cpumask_copy(top_cpuset.effective_xcpus, cpu_possible_mask);
>
>
> Reviewed-by: Ridong Chen <ridong.chen@linux.dev>
> Thanks.
>
Thanks for the review.

Cheers,
Longman