linux-kernel - Re: [PATCH -next RFC 01/11] cpuset: move the root cpuset write check earlier

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <e02b9c35-c51e-45c0-a2ca-3d1f0492af23@redhat.com>
Date: Fri, 29 Aug 2025 15:21:21 -0400
From: Waiman Long <llong@...hat.com>
To: Chen Ridong <chenridong@...weicloud.com>, tj@...nel.org,
 hannes@...xchg.org, mkoutny@...e.com
Cc: cgroups@...r.kernel.org, linux-kernel@...r.kernel.org,
 lujialin4@...wei.com, chenridong@...wei.com
Subject: Re: [PATCH -next RFC 01/11] cpuset: move the root cpuset write check
 earlier

On 8/28/25 8:56 AM, Chen Ridong wrote:
> From: Chen Ridong <chenridong@...wei.com>
>
> The 'cpus' or 'mems' lists of the top_cpuset cannot be modified.
> This check can be moved before acquiring any locks as a common code
> block to improve efficiency and maintainability.
>
> Signed-off-by: Chen Ridong <chenridong@...wei.com>
> ---
>   kernel/cgroup/cpuset.c | 22 +++++++++-------------
>   1 file changed, 9 insertions(+), 13 deletions(-)
>
> diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
> index a78ccd11ce9b..7e6a40e361ea 100644
> --- a/kernel/cgroup/cpuset.c
> +++ b/kernel/cgroup/cpuset.c
> @@ -337,6 +337,11 @@ static inline bool cpuset_v2(void)
>   		cgroup_subsys_on_dfl(cpuset_cgrp_subsys);
>   }
>   
> +static inline bool cpuset_is_root(struct cpuset *cs)
> +{
> +	return (cs == &top_cpuset);
> +}
> +
>   /*
>    * Cgroup v2 behavior is used on the "cpus" and "mems" control files when
>    * on default hierarchy or when the cpuset_v2_mode flag is set by mounting
> @@ -2334,10 +2339,6 @@ static int update_cpumask(struct cpuset *cs, struct cpuset *trialcs,
>   	bool force = false;
>   	int old_prs = cs->partition_root_state;
>   
> -	/* top_cpuset.cpus_allowed tracks cpu_active_mask; it's read-only */
> -	if (cs == &top_cpuset)
> -		return -EACCES;
> -
>   	/*
>   	 * An empty cpus_allowed is ok only if the cpuset has no tasks.
>   	 * Since cpulist_parse() fails on an empty mask, we special case
> @@ -2783,15 +2784,6 @@ static int update_nodemask(struct cpuset *cs, struct cpuset *trialcs,
>   {
>   	int retval;
>   
> -	/*
> -	 * top_cpuset.mems_allowed tracks node_stats[N_MEMORY];
> -	 * it's read-only
> -	 */
> -	if (cs == &top_cpuset) {
> -		retval = -EACCES;
> -		goto done;
> -	}
> -
>   	/*
>   	 * An empty mems_allowed is ok iff there are no tasks in the cpuset.
>   	 * Since nodelist_parse() fails on an empty mask, we special case
> @@ -3257,6 +3249,10 @@ ssize_t cpuset_write_resmask(struct kernfs_open_file *of,
>   	struct cpuset *trialcs;
>   	int retval = -ENODEV;
>   
> +	/* root is read-only */
> +	if (cpuset_is_root(cs))
> +		return -EACCES;
> +
>   	buf = strstrip(buf);
>   	cpuset_full_lock();
>   	if (!is_cpuset_online(cs))

The (cs == &top_cpuset) check is pretty straight forward. So if the 
cpuset_is_root() helper is only used once, I don't think we need a new 
helper here.

Cheers,
Longman