Re: [PATCH] cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode()

[Waiman Long]

On 9/29/26 9:57 PM, Ridong Chen wrote:
> On 9/30/2026 9:28 AM, Waiman Long wrote:
> > After seeing the patch [1] to guard is_in_v2_mode() with RCU, it makes
> > me realize that is_in_v2_mode() may be called in a context where a new
> > cgroup filesystem is being rebound with stale cpuset_cgrp_subsys.root
> > pointer. Avoid this potential UaF situation by adding a new 
> > cpuset_v2_mode
> > flag which is set when the cpuset_v2_mode mount option is used. This
> > flag is written into only when cpuset_bind() is being called with a
> > stable cpuset_cgrp_subsys.root value. The is_in_v2_mode() helper is
> > modified to read the new cpuset_v2_mode flag instead of accessing
> > cpuset_cgrp_subsys.root directly.
> >
> > [1] 
> > https://lore.kernel.org/lkml/20260929084124.626693-2-arighi@xxxxxxxxxx
> >
> > Fixes: b8d1b8ee93df ("cpuset: Allow v2 behavior in v1 cgroup")
> > Signed-off-by: Waiman Long <longman@xxxxxxxxxx>
> > ---
> >   kernel/cgroup/cpuset.c | 10 ++++++++--
> >   1 file changed, 8 insertions(+), 2 deletions(-)
> >
> > diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
> > index 19661df6244f..266ce17d1af0 100644
> > --- a/kernel/cgroup/cpuset.c
> > +++ b/kernel/cgroup/cpuset.c
> > @@ -147,6 +147,11 @@ static cpumask_var_t subpartitions_cpus;    /* 
> > RWCS */
> >    */
> >   static cpumask_var_t    isolated_cpus;        /* CSCB */
> >   +/*
> > + * Set if "cpuset_v2_mode" mount option is used
> > + */
> > +static bool        cpuset_v2_mode;        /* Unprotected */
> > +
>
> Nit.
>
> `Unprotected` is wired here, will it be better with:
>
> /* Cached at bind time; accessed via {READ,WRITE}_ONCE */
Unprotected just means it is not protected by any lock. I should have 
said "not lock protected".
> >   /*
> >    * Set if housekeeping cpumasks are to be updated.
> >    */
> > @@ -439,8 +444,7 @@ static inline bool cpuset_v2(void)
> >    */
> >   static inline bool is_in_v2_mode(void)
> >   {
> > -    return cpuset_v2() ||
> > -          (cpuset_cgrp_subsys.root->flags & CGRP_ROOT_CPUSET_V2_MODE);
> > +    return cpuset_v2() || READ_ONCE(cpuset_v2_mode);
> >   }
> >     /**
> > @@ -3664,6 +3668,8 @@ static void cpuset_bind(struct 
> > cgroup_subsys_state *root_css)
> >       mutex_lock(&cpuset_mutex);
> >       spin_lock_irq(&callback_lock);
> >   +    WRITE_ONCE(cpuset_v2_mode,
> > +           !!(cpuset_cgrp_subsys.root->flags & 
> > CGRP_ROOT_CPUSET_V2_MODE));
> >       if (is_in_v2_mode()) {
> >           cpumask_copy(top_cpuset.cpus_allowed, cpu_possible_mask);
> >           cpumask_copy(top_cpuset.effective_xcpus, cpu_possible_mask);
>
>
> Reviewed-by: Ridong Chen <ridong.chen@xxxxxxxxx>
> Thanks.
Thanks for the review.

Cheers,
Longman