cgroup/cpuset: Fix race between newly created partition and dying one

[ Upstream commit a22b3d54de94f82ca057cc2ebf9496fa91ebf698 ]

There is a possible race between removing a cgroup diectory that is
a partition root and the creation of a new partition.  The partition
to be removed can be dying but still online, it doesn't not currently
participate in checking for exclusive CPUs conflict, but the exclusive
CPUs are still there in subpartitions_cpus and isolated_cpus. These
two cpumasks are global states that affect the operation of cpuset
partitions. The exclusive CPUs in dying cpusets will only be removed
when cpuset_css_offline() function is called after an RCU delay.

As a result, it is possible that a new partition can be created with
exclusive CPUs that overlap with those of a dying one. When that dying
partition is finally offlined, it removes those overlapping exclusive
CPUs from subpartitions_cpus and maybe isolated_cpus resulting in an
incorrect CPU configuration.

This bug was found when a warning was triggered in
remote_partition_disable() during testing because the subpartitions_cpus
mask was empty.

One possible way to fix this is to iterate the dying cpusets as well and
avoid using the exclusive CPUs in those dying cpusets. However, this
can still cause random partition creation failures or other anomalies
due to racing. A better way to fix this race is to reset the partition
state at the moment when a cpuset is being killed.

Introduce a new css_killed() CSS function pointer and call it, if
defined, before setting CSS_DYING flag in kill_css(). Also update the
css_is_dying() helper to use the CSS_DYING flag introduced by commit
33c35aa48178 ("cgroup: Prevent kill_css() from being called more than
once") for proper synchronization.

Add a new cpuset_css_killed() function to reset the partition state of
a valid partition root if it is being killed.

Fixes: ee8dde0cd2ce ("cpuset: Add new v2 cpuset.sched.partition flag")
Signed-off-by: Waiman Long <longman@redhat.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/include/linux/cgroup-defs.h b/include/linux/cgroup-defs.h
index 38b2af336e4a01e91657f074de7084ac62580137..252eed781a6e949bd2f1fd3d008658fb0a0da4ba 100644 (file)
--- a/include/linux/cgroup-defs.h
+++ b/include/linux/cgroup-defs.h
@@ -711,6 +711,7 @@ struct cgroup_subsys {
        void (*css_released)(struct cgroup_subsys_state *css);
        void (*css_free)(struct cgroup_subsys_state *css);
        void (*css_reset)(struct cgroup_subsys_state *css);
+       void (*css_killed)(struct cgroup_subsys_state *css);
        void (*css_rstat_flush)(struct cgroup_subsys_state *css, int cpu);
        int (*css_extra_stat_show)(struct seq_file *seq,
                                   struct cgroup_subsys_state *css);

diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h
index f8ef47f8a634df490a8aea2344183f6b1c08aa9f..fc1324ed597d6b3ebb93387419882110f59291c7 100644 (file)
--- a/include/linux/cgroup.h
+++ b/include/linux/cgroup.h
@@ -343,7 +343,7 @@ static inline u64 cgroup_id(const struct cgroup *cgrp)
  */
 static inline bool css_is_dying(struct cgroup_subsys_state *css)
 {
-       return !(css->flags & CSS_NO_REF) && percpu_ref_is_dying(&css->refcnt);
+       return css->flags & CSS_DYING;
 }
 
 static inline void cgroup_get(struct cgroup *cgrp)

diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
index 216535e055e112126051600c4a239becd9729659..4378f3eff25d25aafaecc18dd2792a791881c58c 100644 (file)
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -5909,6 +5909,12 @@ static void kill_css(struct cgroup_subsys_state *css)
        if (css->flags & CSS_DYING)
                return;
 
+       /*
+        * Call css_killed(), if defined, before setting the CSS_DYING flag
+        */
+       if (css->ss->css_killed)
+               css->ss->css_killed(css);
+
        css->flags |= CSS_DYING;
 
        /*

diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
index 07ea3a563150b16d58215d3ad4e2e208f6727347..839f88ba17f7d3950a974be3bb4dcd03a405b073 100644 (file)
--- a/kernel/cgroup/cpuset.c
+++ b/kernel/cgroup/cpuset.c
@@ -3479,9 +3479,6 @@ static void cpuset_css_offline(struct cgroup_subsys_state *css)
        cpus_read_lock();
        mutex_lock(&cpuset_mutex);
 
-       if (is_partition_valid(cs))
-               update_prstate(cs, 0);
-
        if (!cpuset_v2() && is_sched_load_balance(cs))
                cpuset_update_flag(CS_SCHED_LOAD_BALANCE, cs, 0);
 
@@ -3492,6 +3489,22 @@ static void cpuset_css_offline(struct cgroup_subsys_state *css)
        cpus_read_unlock();
 }
 
+static void cpuset_css_killed(struct cgroup_subsys_state *css)
+{
+       struct cpuset *cs = css_cs(css);
+
+       cpus_read_lock();
+       mutex_lock(&cpuset_mutex);
+
+       /* Reset valid partition back to member */
+       if (is_partition_valid(cs))
+               update_prstate(cs, PRS_MEMBER);
+
+       mutex_unlock(&cpuset_mutex);
+       cpus_read_unlock();
+
+}
+
 static void cpuset_css_free(struct cgroup_subsys_state *css)
 {
        struct cpuset *cs = css_cs(css);
@@ -3613,6 +3626,7 @@ struct cgroup_subsys cpuset_cgrp_subsys = {
        .css_alloc      = cpuset_css_alloc,
        .css_online     = cpuset_css_online,
        .css_offline    = cpuset_css_offline,
+       .css_killed     = cpuset_css_killed,
        .css_free       = cpuset_css_free,
        .can_attach     = cpuset_can_attach,
        .cancel_attach  = cpuset_cancel_attach,