| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <20251117024627.1128037-19-chenridong@huaweicloud.com>
Date: Mon, 17 Nov 2025 02:46:24 +0000
From: Chen Ridong <chenridong@...weicloud.com>
To: longman@...hat.com,
tj@...nel.org,
hannes@...xchg.org,
mkoutny@...e.com
Cc: cgroups@...r.kernel.org,
linux-kernel@...r.kernel.org,
lujialin4@...wei.com,
chenridong@...wei.com
Subject: [PATCH -next 18/21] cpuset: introduce validate_remote_partition
From: Chen Ridong <chenridong@...wei.com>
This introduces validate_remote_partition() to consolidate validation
logic for remote partition operations. It will be used by both
remote_partition_enable() and remote_partition_disable().
The new function performs the following checks:
1. Privilege requirement: only CAP_SYS_ADMIN can add CPUs to a
remote partition.
2. Conflict check: ensure added CPUs are not in any existing
sub-partitions and that there is at least one online CPU in the
excluded mask.
3. Resource check: prevent allocating all top cpuset's effective CPUs
to remote partitions.
4. Common partition validation.
Additionally, this patch adds error handling for remote_partition_disable()
so that cs->prs_err can be updated centrally.
Signed-off-by: Chen Ridong <chenridong@...wei.com>
---
kernel/cgroup/cpuset.c | 118 +++++++++++++++++++++--------------------
1 file changed, 60 insertions(+), 58 deletions(-)
diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
index b75d27a59ba9..8690f144b208 100644
--- a/kernel/cgroup/cpuset.c
+++ b/kernel/cgroup/cpuset.c
@@ -1744,6 +1744,47 @@ static void partition_update(struct cpuset *cs, int prs, struct cpumask *xcpus,
notify_partition_change(cs, old_prs);
}
+/**
+ * validate_remote_partition - Validate for remote partition
+ * @cs: Target cpuset to validate
+ * @new_prs: New partition root state to validate
+ * @excpus: New exclusive effectuve CPUs mask to validate
+ * @add: exclusive CPUs to be added
+ * @del: exclusive CPUs to be deleted, can be NULL
+ *
+ * Return: PERR_NONE if validation passes, appropriate error code otherwise
+ */
+static enum prs_errcode validate_remote_partition(struct cpuset *cs,
+ int new_prs, struct cpumask *excpus, struct cpumask *add, struct cpumask *del)
+{
+ /*
+ * The user must have sysadmin privilege.
+ */
+ if (!cpumask_empty(add) && !capable(CAP_SYS_ADMIN))
+ return PERR_ACCESS;
+
+ /*
+ * Additions of remote CPUs is only allowed if those CPUs are
+ * not allocated to other partitions and there are effective_cpus
+ * left in the top cpuset.
+ *
+ * The effective_xcpus mask can contain offline CPUs, but there must
+ * be at least one or more online CPUs present before it can be enabled.
+ */
+ if (cpumask_intersects(add, subpartitions_cpus) ||
+ !cpumask_intersects(excpus, cpu_active_mask))
+ return PERR_INVCPUS;
+
+ /*
+ * It is not allowed that all effective_cpus of top_cpuset are
+ * distributed remote partition
+ */
+ if (cpumask_subset(top_cpuset.effective_cpus, excpus))
+ return PERR_NOCPUS;
+
+ return validate_partition(cs, new_prs, excpus, add, del);
+}
+
/*
* remote_partition_enable - Enable current cpuset as a remote partition root
* @cs: the cpuset to update
@@ -1757,31 +1798,15 @@ static void partition_update(struct cpuset *cs, int prs, struct cpumask *xcpus,
static int remote_partition_enable(struct cpuset *cs, int new_prs,
struct tmpmasks *tmp)
{
- /*
- * The user must have sysadmin privilege.
- */
- if (!capable(CAP_SYS_ADMIN))
- return PERR_ACCESS;
- /*
- * The requested exclusive_cpus must not be allocated to other
- * partitions and it can't use up all the root's effective_cpus.
- *
- * The effective_xcpus mask can contain offline CPUs, but there must
- * be at least one or more online CPUs present before it can be enabled.
- *
- * Note that creating a remote partition with any local partition root
- * above it or remote partition root underneath it is not allowed.
- */
+ enum prs_errcode err;
+
compute_excpus(cs, tmp->new_cpus);
WARN_ON_ONCE(cpumask_intersects(tmp->new_cpus, subpartitions_cpus));
- if (!cpumask_intersects(tmp->new_cpus, cpu_active_mask) ||
- cpumask_subset(top_cpuset.effective_cpus, tmp->new_cpus))
- return PERR_INVCPUS;
- if (((new_prs == PRS_ISOLATED) &&
- !isolated_cpus_can_update(tmp->new_cpus, NULL)) ||
- prstate_housekeeping_conflict(new_prs, tmp->new_cpus))
- return PERR_HKEEPING;
+ err = validate_remote_partition(cs, new_prs, tmp->new_cpus,
+ tmp->new_cpus, NULL);
+ if (err)
+ return err;
partition_enable(cs, NULL, new_prs, tmp->new_cpus);
/*
@@ -1801,15 +1826,16 @@ static int remote_partition_enable(struct cpuset *cs, int new_prs,
*
* cpuset_mutex must be held by the caller.
*/
-static void remote_partition_disable(struct cpuset *cs, struct tmpmasks *tmp)
+static void remote_partition_disable(struct cpuset *cs,
+ enum prs_errcode prs_err, struct tmpmasks *tmp)
{
int new_prs;
WARN_ON_ONCE(!is_remote_partition(cs));
WARN_ON_ONCE(!cpumask_subset(cs->effective_xcpus, subpartitions_cpus));
- new_prs = cs->prs_err ? -cs->partition_root_state : PRS_MEMBER;
- partition_disable(cs, NULL, new_prs, cs->prs_err);
+ new_prs = prs_err ? -cs->partition_root_state : PRS_MEMBER;
+ partition_disable(cs, NULL, new_prs, prs_err);
/*
* Propagate changes in top_cpuset's effective_cpus down the hierarchy.
@@ -1831,39 +1857,19 @@ static void remote_partition_disable(struct cpuset *cs, struct tmpmasks *tmp)
static void remote_cpus_update(struct cpuset *cs, struct cpumask *xcpus,
struct cpumask *excpus, struct tmpmasks *tmp)
{
- int prs = cs->partition_root_state;
+ enum prs_errcode err;
if (WARN_ON_ONCE(!is_remote_partition(cs)))
return;
WARN_ON_ONCE(!cpumask_subset(cs->effective_xcpus, subpartitions_cpus));
-
- if (cpumask_empty(excpus)) {
- cs->prs_err = PERR_CPUSEMPTY;
- goto invalidate;
- }
-
cpumask_andnot(tmp->addmask, excpus, cs->effective_xcpus);
cpumask_andnot(tmp->delmask, cs->effective_xcpus, excpus);
- /*
- * Additions of remote CPUs is only allowed if those CPUs are
- * not allocated to other partitions and there are effective_cpus
- * left in the top cpuset.
- */
- if (!cpumask_empty(tmp->addmask)) {
- WARN_ON_ONCE(cpumask_intersects(tmp->addmask, subpartitions_cpus));
- if (!capable(CAP_SYS_ADMIN))
- cs->prs_err = PERR_ACCESS;
- else if (cpumask_intersects(tmp->addmask, subpartitions_cpus) ||
- cpumask_subset(top_cpuset.effective_cpus, tmp->addmask))
- cs->prs_err = PERR_NOCPUS;
- else if ((prs == PRS_ISOLATED) &&
- !isolated_cpus_can_update(tmp->addmask, tmp->delmask))
- cs->prs_err = PERR_HKEEPING;
- if (cs->prs_err)
- goto invalidate;
- }
+ err = validate_remote_partition(cs, cs->partition_root_state, excpus,
+ tmp->addmask, tmp->delmask);
+ if (err)
+ return remote_partition_disable(cs, err, tmp);
partition_update(cs, cs->partition_root_state, xcpus, excpus, tmp);
/*
@@ -1872,9 +1878,6 @@ static void remote_cpus_update(struct cpuset *cs, struct cpumask *xcpus,
cpuset_update_tasks_cpumask(&top_cpuset, tmp->new_cpus);
update_sibling_cpumasks(&top_cpuset, NULL, tmp);
return;
-
-invalidate:
- remote_partition_disable(cs, tmp);
}
static bool is_user_xcpus_exclusive(struct cpuset *cs)
@@ -2456,11 +2459,11 @@ static void partition_cpus_change(struct cpuset *cs, struct cpuset *trialcs,
prs_err = validate_partition(cs, trialcs->partition_root_state,
trialcs->effective_xcpus, trialcs->effective_xcpus, NULL);
if (prs_err)
- trialcs->prs_err = cs->prs_err = prs_err;
+ trialcs->prs_err = prs_err;
if (is_remote_partition(cs)) {
if (trialcs->prs_err)
- remote_partition_disable(cs, tmp);
+ remote_partition_disable(cs, trialcs->prs_err, tmp);
else
remote_cpus_update(cs, trialcs->exclusive_cpus,
trialcs->effective_xcpus, tmp);
@@ -3000,7 +3003,7 @@ static int update_prstate(struct cpuset *cs, int new_prs)
* disables child partitions.
*/
if (is_remote_partition(cs))
- remote_partition_disable(cs, &tmpmask);
+ remote_partition_disable(cs, PERR_NONE, &tmpmask);
else
local_partition_disable(cs, PERR_NONE, &tmpmask);
/*
@@ -3887,8 +3890,7 @@ static void cpuset_hotplug_update_tasks(struct cpuset *cs, struct tmpmasks *tmp)
compute_partition_effective_cpumask(cs, &new_cpus);
if (cpumask_empty(&new_cpus) &&
partition_is_populated(cs, NULL)) {
- cs->prs_err = PERR_HOTPLUG;
- remote_partition_disable(cs, tmp);
+ remote_partition_disable(cs, PERR_HOTPLUG, tmp);
compute_effective_cpumask(&new_cpus, cs, parent);
}
goto update_tasks;
--
2.34.1
Powered by blists - more mailing lists