| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <20251025064844.495525-21-chenridong@huaweicloud.com>
Date: Sat, 25 Oct 2025 06:48:42 +0000
From: Chen Ridong <chenridong@...weicloud.com>
To: longman@...hat.com,
tj@...nel.org,
hannes@...xchg.org,
mkoutny@...e.com
Cc: cgroups@...r.kernel.org,
linux-kernel@...r.kernel.org,
lujialin4@...wei.com,
chenridong@...wei.com
Subject: [PATCH RFC v2 20/22] cpuset: introduce validate_remote_partition
From: Chen Ridong <chenridong@...wei.com>
This introduces validate_remote_partition() to consolidate validation
logic for remote partition operations. It will be used by both
remote_partition_enable() and remote_partition_disable().
The new function performs the following checks:
1. Privilege requirement: only CAP_SYS_ADMIN can add CPUs to a
remote partition.
2. Conflict check: ensure added CPUs are not in any existing
sub-partitions and that there is at least one online CPU in the
excluded mask.
3. Resource check: prevent allocating all top cpuset's effective CPUs
to remote partitions.
4. Common partition validation.
Additionally, this patch adds error handling for remote_partition_disable()
so that cs->prs_err can be updated centrally.
Signed-off-by: Chen Ridong <chenridong@...wei.com>
---
kernel/cgroup/cpuset.c | 111 ++++++++++++++++++++++-------------------
1 file changed, 59 insertions(+), 52 deletions(-)
diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
index feb8413eaffa..52ef58e94926 100644
--- a/kernel/cgroup/cpuset.c
+++ b/kernel/cgroup/cpuset.c
@@ -1679,6 +1679,46 @@ static enum prs_errcode validate_partition(struct cpuset *cs, int new_prs,
return PERR_NONE;
}
+/**
+ * validate_remote_partition - Validate for remote partition
+ * @cs: Target cpuset to validate
+ * @new_prs: New partition root state to validate
+ * @excpus: New exclusive effectuve CPUs mask to validate
+ * @addmask: New CPU mask to be added to exclusive CPUs
+ *
+ * Return: PERR_NONE if validation passes, appropriate error code otherwise
+ */
+static enum prs_errcode validate_remote_partition(struct cpuset *cs,
+ int new_prs, struct cpumask *excpus, struct cpumask *addmask)
+{
+ /*
+ * The user must have sysadmin privilege.
+ */
+ if (!cpumask_empty(addmask) && !capable(CAP_SYS_ADMIN))
+ return PERR_ACCESS;
+
+ /*
+ * Additions of remote CPUs is only allowed if those CPUs are
+ * not allocated to other partitions and there are effective_cpus
+ * left in the top cpuset.
+ *
+ * The effective_xcpus mask can contain offline CPUs, but there must
+ * be at least one or more online CPUs present before it can be enabled.
+ */
+ if (cpumask_intersects(addmask, subpartitions_cpus) ||
+ !cpumask_intersects(excpus, cpu_active_mask))
+ return PERR_INVCPUS;
+
+ /*
+ * It is not allowed that all effective_cpus of top_cpuset are
+ * distributed remote partition
+ */
+ if (cpumask_subset(top_cpuset.effective_cpus, excpus))
+ return PERR_NOCPUS;
+
+ return validate_partition(cs, new_prs, excpus);
+}
+
/*
* remote_partition_enable - Enable current cpuset as a remote partition root
* @cs: the cpuset to update
@@ -1692,27 +1732,13 @@ static enum prs_errcode validate_partition(struct cpuset *cs, int new_prs,
static int remote_partition_enable(struct cpuset *cs, int new_prs,
struct tmpmasks *tmp)
{
- /*
- * The user must have sysadmin privilege.
- */
- if (!capable(CAP_SYS_ADMIN))
- return PERR_ACCESS;
+ enum prs_errcode err;
- /*
- * The requested exclusive_cpus must not be allocated to other
- * partitions and it can't use up all the root's effective_cpus.
- *
- * The effective_xcpus mask can contain offline CPUs, but there must
- * be at least one or more online CPUs present before it can be enabled.
- *
- * Note that creating a remote partition with any local partition root
- * above it or remote partition root underneath it is not allowed.
- */
compute_excpus(cs, tmp->new_cpus);
WARN_ON_ONCE(cpumask_intersects(tmp->new_cpus, subpartitions_cpus));
- if (!cpumask_intersects(tmp->new_cpus, cpu_active_mask) ||
- cpumask_subset(top_cpuset.effective_cpus, tmp->new_cpus))
- return PERR_INVCPUS;
+ err = validate_remote_partition(cs, new_prs, tmp->new_cpus, tmp->new_cpus);
+ if (err)
+ return err;
partition_enable(cs, NULL, new_prs, tmp->new_cpus);
/*
@@ -1726,21 +1752,23 @@ static int remote_partition_enable(struct cpuset *cs, int new_prs,
/*
* remote_partition_disable - Remove current cpuset from remote partition list
* @cs: the cpuset to update
+ * @prs_err: partition error when @cs is disabled
* @tmp: temporary masks
*
* The effective_cpus is also updated.
*
* cpuset_mutex must be held by the caller.
*/
-static void remote_partition_disable(struct cpuset *cs, struct tmpmasks *tmp)
+static void remote_partition_disable(struct cpuset *cs,
+ enum prs_errcode prs_err, struct tmpmasks *tmp)
{
int new_prs;
WARN_ON_ONCE(!is_remote_partition(cs));
WARN_ON_ONCE(!cpumask_subset(cs->effective_xcpus, subpartitions_cpus));
- new_prs = cs->prs_err ? -cs->partition_root_state : PRS_MEMBER;
- partition_disable(cs, NULL, new_prs, cs->prs_err);
+ new_prs = prs_err ? -cs->partition_root_state : PRS_MEMBER;
+ partition_disable(cs, NULL, new_prs, prs_err);
/*
* Propagate changes in top_cpuset's effective_cpus down the hierarchy.
*/
@@ -1761,34 +1789,18 @@ static void remote_partition_disable(struct cpuset *cs, struct tmpmasks *tmp)
static void remote_cpus_update(struct cpuset *cs, struct cpumask *xcpus,
struct cpumask *excpus, struct tmpmasks *tmp)
{
+ enum prs_errcode err;
+
if (WARN_ON_ONCE(!is_remote_partition(cs)))
return;
WARN_ON_ONCE(!cpumask_subset(cs->effective_xcpus, subpartitions_cpus));
-
- if (cpumask_empty(excpus)) {
- cs->prs_err = PERR_CPUSEMPTY;
- goto invalidate;
- }
-
cpumask_andnot(tmp->addmask, excpus, cs->effective_xcpus);
cpumask_andnot(tmp->delmask, cs->effective_xcpus, excpus);
-
- /*
- * Additions of remote CPUs is only allowed if those CPUs are
- * not allocated to other partitions and there are effective_cpus
- * left in the top cpuset.
- */
- if (!cpumask_empty(tmp->addmask)) {
- WARN_ON_ONCE(cpumask_intersects(tmp->addmask, subpartitions_cpus));
- if (!capable(CAP_SYS_ADMIN))
- cs->prs_err = PERR_ACCESS;
- else if (cpumask_intersects(tmp->addmask, subpartitions_cpus) ||
- cpumask_subset(top_cpuset.effective_cpus, tmp->addmask))
- cs->prs_err = PERR_NOCPUS;
- if (cs->prs_err)
- goto invalidate;
- }
+ err = validate_remote_partition(cs, cs->partition_root_state,
+ excpus, tmp->addmask);
+ if (err)
+ return remote_partition_disable(cs, err, tmp);
partition_update(cs, cs->partition_root_state, xcpus, excpus, tmp);
/*
@@ -1796,10 +1808,6 @@ static void remote_cpus_update(struct cpuset *cs, struct cpumask *xcpus,
*/
cpuset_update_tasks_cpumask(&top_cpuset, tmp->new_cpus);
update_sibling_cpumasks(&top_cpuset, NULL, tmp);
- return;
-
-invalidate:
- remote_partition_disable(cs, tmp);
}
static bool is_user_cpus_exclusive(struct cpuset *cs)
@@ -2408,11 +2416,11 @@ static void partition_cpus_change(struct cpuset *cs, struct cpuset *trialcs,
prs_err = validate_partition(cs, trialcs->partition_root_state,
trialcs->effective_xcpus);
if (prs_err)
- trialcs->prs_err = cs->prs_err = prs_err;
+ trialcs->prs_err = prs_err;
if (is_remote_partition(cs)) {
if (trialcs->prs_err)
- remote_partition_disable(cs, tmp);
+ remote_partition_disable(cs, trialcs->prs_err, tmp);
else
remote_cpus_update(cs, trialcs->exclusive_cpus,
trialcs->effective_xcpus, tmp);
@@ -2952,7 +2960,7 @@ static int update_prstate(struct cpuset *cs, int new_prs)
* disables child partitions.
*/
if (is_remote_partition(cs))
- remote_partition_disable(cs, &tmpmask);
+ remote_partition_disable(cs, PERR_NONE, &tmpmask);
else
local_partition_disable(cs, PERR_NONE, &tmpmask);
/*
@@ -3841,8 +3849,7 @@ static void cpuset_hotplug_update_tasks(struct cpuset *cs, struct tmpmasks *tmp)
compute_partition_effective_cpumask(cs, &new_cpus);
if (cpumask_empty(&new_cpus) &&
partition_is_populated(cs, NULL)) {
- cs->prs_err = PERR_HOTPLUG;
- remote_partition_disable(cs, tmp);
+ remote_partition_disable(cs, PERR_HOTPLUG, tmp);
compute_effective_cpumask(&new_cpus, cs, parent);
}
goto update_tasks;
--
2.34.1
Powered by blists - more mailing lists