linux-kernel - [PATCH 1/2] cgroup2: cpuset: Disable subset validation on set

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20210413090235.1903026-2-odin@uged.al>
Date:   Tue, 13 Apr 2021 11:02:34 +0200
From:   Odin Ugedal <odin@...d.al>
To:     tj@...nel.org, lizefan.x@...edance.com
Cc:     cgroups@...r.kernel.org, linux-kernel@...r.kernel.org,
        Odin Ugedal <odin@...d.al>
Subject: [PATCH 1/2] cgroup2: cpuset: Disable subset validation on set

Due to how cpuset works in v2, there is no need to check if direct
children are subsets of the new cpuset. In v2, the effective cpuset
of a cgroup is the intersection between the effective value of the parent
and the cpuset.cpus value of the cgroup, with a fallback to the effective
parent value in case the intersection is an empty set.

Therefore, in v2, it is allowed to set cpuset.cpus to a a value that is
not a subset of the parents effective value, resulting in inheriting the
effective cpuset from the parent. Therefore the validation when updating
the parent cpuset (in this case) is not necessary, and can be disabled.

Example:

  /sys/fs/cgroup/A     (cpus=1-2,cpus.effective=1-2)
  /sys/fs/cgroup/A/B   (cpus="", cpus.effective=1-2)

  Setting cpus to 3-4 is possible for A/B

  /sys/fs/cgroup/A     (cpus=1-2,cpus.effective=1-2)
  /sys/fs/cgroup/A/B   (cpus=3-4,cpus.effective=1-2)

  Setting cpus to 1 for A would result in an -EBUSY error, but
  with this patch it will work as expected:

  /sys/fs/cgroup/A     (cpus=1,  cpus.effective=1)
  /sys/fs/cgroup/A/B   (cpus=3-4,cpus.effective=1)

This also applies in a similar manner on cpuset.mems.

Signed-off-by: Odin Ugedal <odin@...d.al>
---
 kernel/cgroup/cpuset.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
index 5258b68153e0..f543c4c6084a 100644
--- a/kernel/cgroup/cpuset.c
+++ b/kernel/cgroup/cpuset.c
@@ -572,11 +572,13 @@ static int validate_change(struct cpuset *cur, struct cpuset *trial)
 
 	rcu_read_lock();
 
-	/* Each of our child cpusets must be a subset of us */
+	/* On legacy hierarchy, each of our child cpusets must be a subset of us */
 	ret = -EBUSY;
-	cpuset_for_each_child(c, css, cur)
-		if (!is_cpuset_subset(c, trial))
-			goto out;
+	if (!is_in_v2_mode()) {
+		cpuset_for_each_child(c, css, cur)
+			if (!is_cpuset_subset(c, trial))
+				goto out;
+	}
 
 	/* Remaining checks don't apply to root cpuset */
 	ret = 0;
-- 
2.31.0