cgroup/cpuset: Reset DL migration state on can_attach() failure

cpuset_can_attach() accumulates temporary SCHED_DEADLINE migration
state in the destination cpuset while walking the taskset.

If a later task_can_attach() or security_task_setscheduler() check
fails, cgroup_migrate_execute() treats cpuset as the failing subsystem
and does not call cpuset_cancel_attach() for it. The partially
accumulated state is then left behind and can be consumed by a later
attach, corrupting cpuset DL task accounting and pending DL bandwidth
accounting.

Reset the pending DL migration state from the common error exit when
ret is non-zero. Successful can_attach() keeps the state for
cpuset_attach() or cpuset_cancel_attach().

Fixes: 2ef269ef1ac0 ("cgroup/cpuset: Free DL BW in case can_attach() fails")
Cc: stable@vger.kernel.org # v6.10+
Signed-off-by: Guopeng Zhang <zhangguopeng@kylinos.cn>
Signed-off-by: Tejun Heo <tj@kernel.org>
Reviewed-by: Chen Ridong <chenridong@huaweicloud.com>
Reviewed-by: Waiman Long <longman@redhat.com>

diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
index a48901a0416a28d064d75aeea6a703f3172da55a..3fbf6e7f68c311194b3e27db87928b2394a0c6bd 100644 (file)
--- a/kernel/cgroup/cpuset.c
+++ b/kernel/cgroup/cpuset.c
@@ -3050,16 +3050,13 @@ static int cpuset_can_attach(struct cgroup_taskset *tset)
                int cpu = cpumask_any_and(cpu_active_mask, cs->effective_cpus);
 
                if (unlikely(cpu >= nr_cpu_ids)) {
-                       reset_migrate_dl_data(cs);
                        ret = -EINVAL;
                        goto out_unlock;
                }
 
                ret = dl_bw_alloc(cpu, cs->sum_migrate_dl_bw);
-               if (ret) {
-                       reset_migrate_dl_data(cs);
+               if (ret)
                        goto out_unlock;
-               }
 
                cs->dl_bw_cpu = cpu;
        }
@@ -3070,7 +3067,10 @@ out_success:
         * changes which zero cpus/mems_allowed.
         */
        cs->attach_in_progress++;
+
 out_unlock:
+       if (ret)
+               reset_migrate_dl_data(cs);
        mutex_unlock(&cpuset_mutex);
        return ret;
 }