| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <606bbc24-53e3-4e09-b48b-d6f72f3194de@huaweicloud.com>
Date: Wed, 5 Nov 2025 15:06:17 +0800
From: Chen Ridong <chenridong@...weicloud.com>
To: Waiman Long <longman@...hat.com>, Tejun Heo <tj@...nel.org>,
Johannes Weiner <hannes@...xchg.org>, Michal Koutný
<mkoutny@...e.com>
Cc: cgroups@...r.kernel.org, linux-kernel@...r.kernel.org,
Chen Ridong <chenridong@...wei.com>, Gabriele Monaco <gmonaco@...hat.com>,
Frederic Weisbecker <frederic@...nel.org>
Subject: Re: [cgroup/for-6.19 PATCH v3 2/5] cgroup/cpuset: Fail if isolated
and nohz_full don't leave any housekeeping
On 2025/11/5 12:38, Waiman Long wrote:
> Currently the user can set up isolated cpus via cpuset and nohz_full in
> such a way that leaves no housekeeping CPU (i.e. no CPU that is neither
> domain isolated nor nohz full). This can be a problem for other
> subsystems (e.g. the timer wheel imgration).
>
> Prevent this configuration by blocking any assignation that would cause
> the union of domain isolated cpus and nohz_full to covers all CPUs.
>
> [longman: Remove isolated_cpus_should_update() and rewrite the checking
> in update_prstate() and update_parent_effective_cpumask()]
>
> Originally-by: Gabriele Monaco <gmonaco@...hat.com>
> Signed-off-by: Waiman Long <longman@...hat.com>
> ---
> kernel/cgroup/cpuset.c | 74 +++++++++++++++++++++++++++++++++++++++++-
> 1 file changed, 73 insertions(+), 1 deletion(-)
>
> diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
> index da770dac955e..99622e90991a 100644
> --- a/kernel/cgroup/cpuset.c
> +++ b/kernel/cgroup/cpuset.c
> @@ -1393,6 +1393,45 @@ static bool partition_xcpus_del(int old_prs, struct cpuset *parent,
> return isolcpus_updated;
> }
>
> +/*
> + * isolated_cpus_can_update - check for isolated & nohz_full conflicts
> + * @add_cpus: cpu mask for cpus that are going to be isolated
> + * @del_cpus: cpu mask for cpus that are no longer isolated, can be NULL
> + * Return: false if there is conflict, true otherwise
> + *
> + * If nohz_full is enabled and we have isolated CPUs, their combination must
> + * still leave housekeeping CPUs.
> + *
> + * TBD: Should consider merging this function into
> + * prstate_housekeeping_conflict().
> + */
> +static bool isolated_cpus_can_update(struct cpumask *add_cpus,
> + struct cpumask *del_cpus)
> +{
> + cpumask_var_t full_hk_cpus;
> + int res = true;
> +
> + if (!housekeeping_enabled(HK_TYPE_KERNEL_NOISE))
> + return true;
> +
> + if (del_cpus && cpumask_weight_and(del_cpus,
> + housekeeping_cpumask(HK_TYPE_KERNEL_NOISE)))
> + return true;
> +
> + if (!alloc_cpumask_var(&full_hk_cpus, GFP_KERNEL))
> + return false;
> +
> + cpumask_and(full_hk_cpus, housekeeping_cpumask(HK_TYPE_KERNEL_NOISE),
> + housekeeping_cpumask(HK_TYPE_DOMAIN));
> + cpumask_andnot(full_hk_cpus, full_hk_cpus, isolated_cpus);
> + cpumask_and(full_hk_cpus, full_hk_cpus, cpu_active_mask);
> + if (!cpumask_weight_andnot(full_hk_cpus, add_cpus))
> + res = false;
> +
> + free_cpumask_var(full_hk_cpus);
> + return res;
> +}
> +
> static void update_isolation_cpumasks(bool isolcpus_updated)
> {
> int ret;
> @@ -1551,6 +1590,9 @@ static int remote_partition_enable(struct cpuset *cs, int new_prs,
> if (!cpumask_intersects(tmp->new_cpus, cpu_active_mask) ||
> cpumask_subset(top_cpuset.effective_cpus, tmp->new_cpus))
> return PERR_INVCPUS;
> + if ((new_prs == PRS_ISOLATED) &&
> + !isolated_cpus_can_update(tmp->new_cpus, NULL))
> + return PERR_HKEEPING;
>
> spin_lock_irq(&callback_lock);
> isolcpus_updated = partition_xcpus_add(new_prs, NULL, tmp->new_cpus);
> @@ -1650,6 +1692,9 @@ static void remote_cpus_update(struct cpuset *cs, struct cpumask *xcpus,
> else if (cpumask_intersects(tmp->addmask, subpartitions_cpus) ||
> cpumask_subset(top_cpuset.effective_cpus, tmp->addmask))
> cs->prs_err = PERR_NOCPUS;
> + else if ((prs == PRS_ISOLATED) &&
> + !isolated_cpus_can_update(tmp->addmask, tmp->delmask))
> + cs->prs_err = PERR_HKEEPING;
> if (cs->prs_err)
> goto invalidate;
> }
> @@ -1750,6 +1795,7 @@ static int update_parent_effective_cpumask(struct cpuset *cs, int cmd,
> int part_error = PERR_NONE; /* Partition error? */
> int isolcpus_updated = 0;
> struct cpumask *xcpus = user_xcpus(cs);
> + int parent_prs = parent->partition_root_state;
> bool nocpu;
>
> lockdep_assert_held(&cpuset_mutex);
> @@ -1813,6 +1859,10 @@ static int update_parent_effective_cpumask(struct cpuset *cs, int cmd,
> if (prstate_housekeeping_conflict(new_prs, xcpus))
> return PERR_HKEEPING;
>
> + if ((new_prs == PRS_ISOLATED) && (new_prs != parent_prs) &&
> + !isolated_cpus_can_update(xcpus, NULL))
> + return PERR_HKEEPING;
> +
> if (tasks_nocpu_error(parent, cs, xcpus))
> return PERR_NOCPUS;
>
> @@ -1866,6 +1916,7 @@ static int update_parent_effective_cpumask(struct cpuset *cs, int cmd,
> *
> * For invalid partition:
> * delmask = newmask & parent->effective_xcpus
> + * The partition may become valid soon.
> */
> if (is_partition_invalid(cs)) {
> adding = false;
> @@ -1880,6 +1931,23 @@ static int update_parent_effective_cpumask(struct cpuset *cs, int cmd,
> deleting = cpumask_and(tmp->delmask, tmp->delmask,
> parent->effective_xcpus);
> }
> +
> + /*
> + * TBD: Invalidate a currently valid child root partition may
> + * still break isolated_cpus_can_update() rule if parent is an
> + * isolated partition.
> + */
> + if (is_partition_valid(cs) && (old_prs != parent_prs)) {
> + if ((parent_prs == PRS_ROOT) &&
> + /* Adding to parent means removing isolated CPUs */
> + !isolated_cpus_can_update(tmp->delmask, tmp->addmask))
> + part_error = PERR_HKEEPING;
> + if ((parent_prs == PRS_ISOLATED) &&
> + /* Adding to parent means adding isolated CPUs */
> + !isolated_cpus_can_update(tmp->addmask, tmp->delmask))
> + part_error = PERR_HKEEPING;
> + }
> +
> /*
> * The new CPUs to be removed from parent's effective CPUs
> * must be present.
> @@ -2994,7 +3062,11 @@ static int update_prstate(struct cpuset *cs, int new_prs)
> * A change in load balance state only, no change in cpumasks.
> * Need to update isolated_cpus.
> */
> - isolcpus_updated = true;
> + if ((new_prs == PRS_ISOLATED) &&
> + !isolated_cpus_can_update(cs->effective_xcpus, NULL))
> + err = PERR_HKEEPING;
> + else
> + isolcpus_updated = true;
> } else {
> /*
> * Switching back to member is always allowed even if it
Reviewed-by: Chen Ridong <chenridong@...wei.com>
--
Best regards,
Ridong
Powered by blists - more mailing lists