Re: [PATCH v2 2/2] cgroup/cpuset: prevent local partition activation over remote partition and sibling xcpus conflict

[Guopeng Zhang]

在 2026/9/20 16:23, Hui Peng 写道:
> Commit 6da580ec656a ("cgroup/cpuset: Don't allow creation of local
> partition over a remote one") added a check in update_prstate() to reject
> creating a top-level local partition whose cs->exclusive_cpus intersects
> subpartitions_cpus.
> 
> However, two paths still allow overlapping exclusive CPU ownership between
> a top-level local partition and a remote partition or sibling:
> 
> 1. If a top-level cgroup A1 has cpuset.cpus.exclusive set, is first set to
>    "root" while cpuset.cpus is empty (becoming "root invalid"), has a
>    child A1/A2 enabled as a remote partition on those exclusive CPUs, and
>    then receives CPUs via A1/cpuset.cpus, update_cpumasks_hier() calls
>    validate_partition() without going through update_prstate(). Because
>    validate_partition() does not check trialcs->exclusive_cpus against
>    subpartitions_cpus, A1 transitions from "root invalid" to a valid local
>    partition over the existing remote partition A1/A2 and triggers:
> 
>      WARNING: kernel/cgroup/cpuset.c:1866 at update_parent_effective_cpumask+0x54a/0x8a0
> 
> 2. In cpus_excl_conflict(), when a valid local partition A1 uses implicit
>    exclusive CPUs (cpuset.cpus set without cpuset.cpus.exclusive, so
>    sibling->exclusive_cpus is empty while sibling->effective_xcpus is
>    populated), a sibling cgroup B1 can still set cpuset.cpus.exclusive on
>    the same CPUs because cpus_excl_conflict() only checks
>    sibling->exclusive_cpus.
> 
> Fix these issues by:
> - Checking trialcs->exclusive_cpus against subpartitions_cpus in
>   validate_partition() when !is_partition_valid(cs).
> - Falling back to sibling->effective_xcpus in cpus_excl_conflict() when
>   sibling->exclusive_cpus is empty.
> - Adding regression test cases for both paths to
>   tools/testing/selftests/cgroup/test_cpuset_prs.sh.
> 
> Tested in QEMU on Linux 7.3.0-rc3 using
> tools/testing/selftests/cgroup/test_cpuset_prs.sh.
> 
> Fixes: 6da580ec656a ("cgroup/cpuset: Don't allow creation of local partition over a remote one")

I think this patch is still missing a Fixes: tag for the
cpus_excl_conflict() change.

The validate_partition() change can be covered by 6da580ec656a.

However, the sibling CPU ownership issue fixed in cpus_excl_conflict()
was introduced by the following commit:
Fixes: 2a3602030d80 ("cgroup/cpuset: Don't invalidate sibling partitions on cpuset.cpus conflict")

Thanks,
Guopeng

> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Hui Peng <benquike@xxxxxxxxx>
> ---
> Changes in v2:
> - Split from the remote_partition_enable() fix into patch 2/2.
> - Check trialcs->exclusive_cpus (rather than effective_xcpus) in
>   validate_partition() when !is_partition_valid(cs) so sibling local
>   partitions with overlapping cpuset.cpus continue to share remaining
>   available CPUs as expected by test_cpuset_prs.sh.
> - Add regression tests to tools/testing/selftests/cgroup/test_cpuset_prs.sh.
> 
>  kernel/cgroup/cpuset.c                        | 9 ++++++++-
>  tools/testing/selftests/cgroup/test_cpuset_prs.sh | 3 +++
>  2 files changed, 11 insertions(+), 1 deletion(-)
> 
> diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
> index 7381fa8502e7..f46a51f07938 100644
> --- a/kernel/cgroup/cpuset.c
> +++ b/kernel/cgroup/cpuset.c
> @@ -713,7 +713,10 @@ static inline bool cpus_excl_conflict(struct cpuset *trial, struct cpuset *sibli
>  		return true;
>  
>  	/* Exclusive_cpus cannot intersect */
> -	return cpumask_intersects(trial->exclusive_cpus, sibling->exclusive_cpus);
> +	return cpumask_intersects(trial->exclusive_cpus,
> +				  cpumask_empty(sibling->exclusive_cpus)
> +				  ? sibling->effective_xcpus
> +				  : sibling->exclusive_cpus);
>  }
>  
>  static inline bool mems_excl_conflict(struct cpuset *cs1, struct cpuset *cs2)
> @@ -2415,6 +2418,10 @@ static enum prs_errcode validate_partition(struct cpuset *cs, struct cpuset *tri
>  	if (cpumask_empty(trialcs->effective_xcpus))
>  		return PERR_INVCPUS;
>  
> +	if ((parent == &top_cpuset) && !is_partition_valid(cs) &&
> +	    cpumask_intersects(trialcs->exclusive_cpus, subpartitions_cpus))
> +		return PERR_REMOTE;
> +
>  	if (prstate_housekeeping_conflict(trialcs->partition_root_state,
>  					  trialcs->effective_xcpus))
>  		return PERR_HKEEPING;
> diff --git a/tools/testing/selftests/cgroup/test_cpuset_prs.sh b/tools/testing/selftests/cgroup/test_cpuset_prs.sh
> index b732078bf319..f62155cf6162 100755
> --- a/tools/testing/selftests/cgroup/test_cpuset_prs.sh
> +++ b/tools/testing/selftests/cgroup/test_cpuset_prs.sh
> @@ -321,6 +321,8 @@ TEST_MATRIX=(
>  	" C1-3:P2  X4:P2    .      .      .    X3:P2    .      .     0 A1:1-2|XA1:1-3|A2:3:XA2:3 A1:P2|A2:P2 1-3"
>  	" C0-3:P2    .      .    C4-6   C0-4     .      .      .     0 A1:0-4|B1:5-6 A1:P2|B1:P0"
>  	" C0-3:P2    .      .    C4-6 C0-4:C0-3  .      .      .     0 A1:0-3|B1:4-6 A1:P2|B1:P0 0-3"
> +	" X1-3:P1 CX2-3:P2  .      .    C1-3     .      .      .     0 A1:1|A2:2-3|XA2:2-3 \
> +								       A1:P-1|A2:P2 2-3"
>  
>  	# Local partition invalidation tests
>  	" C0-3:X1-3:P2 C1-3:X2-3:P2 C2-3:X3:P2 \
> @@ -443,6 +445,7 @@ TEST_MATRIX=(
>  
>  	# Changes to cpuset.cpus.exclusive that violate exclusivity rule is rejected
>  	"   C0-3     .      .    C4-5   X0-3     .      .     X3-5   1 A1:0-3|B1:4-5"
> +	"  C0-3:P1   .      .    C4-5     .      .      .     X3-5   1 A1:0-3|B1:4-5 A1:P1|B1:P0"
>  
>  	# cpuset.cpus.exclusive cannot be set to a superset of sibling's cpuset.cpus
>  	"   C0-3     .      .    C4-5   X3-5     .      .      .     1 A1:0-3|B1:4-5"