[PATCH] cpuset: Treat cpusets in attaching as populated

[PATCH] cpuset: Treat cpusets in attaching as populated

[Chen Ridong]

From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

6.6-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Chen Ridong <chenridong@huawei.com>

[ Upstream commit b1bcaed1e39a9e0dfbe324a15d2ca4253deda316 ]

Currently, the check for whether a partition is populated does not
account for tasks in the cpuset of attaching. This is a corner case
that can leave a task stuck in a partition with no effective CPUs.

The race condition occurs as follows:

cpu0				cpu1
				//cpuset A  with cpu N
migrate task p to A
cpuset_can_attach
// with effective cpus
// check ok

// cpuset_mutex is not held	// clear cpuset.cpus.exclusive
				// making effective cpus empty
				update_exclusive_cpumask
				// tasks_nocpu_error check ok
				// empty effective cpus, partition valid
cpuset_attach
...
// task p stays in A, with non-effective cpus.

To fix this issue, this patch introduces cs_is_populated, which considers
tasks in the attaching cpuset. This new helper is used in validate_change
and partition_is_populated.

Fixes: e2d59900d936 ("cgroup/cpuset: Allow no-task partition to have empty cpuset.cpus.effective")
Signed-off-by: Chen Ridong <chenridong@huawei.com>
Reviewed-by: Waiman Long <longman@redhat.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/cgroup/cpuset.c | 37 ++++++++++++++++++++++++++++---------
 1 file changed, 28 insertions(+), 9 deletions(-)

diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
index eadb028916c8..3c466e742751 100644
--- a/kernel/cgroup/cpuset.c
+++ b/kernel/cgroup/cpuset.c
@@ -453,6 +453,15 @@ static inline bool is_in_v2_mode(void)
 	      (cpuset_cgrp_subsys.root->flags & CGRP_ROOT_CPUSET_V2_MODE);
 }
 
+static inline bool cpuset_is_populated(struct cpuset *cs)
+{
+	lockdep_assert_held(&cpuset_mutex);
+
+	/* Cpusets in the process of attaching should be considered as populated */
+	return cgroup_is_populated(cs->css.cgroup) ||
+		cs->attach_in_progress;
+}
+
 /**
  * partition_is_populated - check if partition has tasks
  * @cs: partition root to be checked
@@ -465,21 +474,31 @@ static inline bool is_in_v2_mode(void)
 static inline bool partition_is_populated(struct cpuset *cs,
 					  struct cpuset *excluded_child)
 {
-	struct cgroup_subsys_state *css;
-	struct cpuset *child;
+	struct cpuset *cp;
+	struct cgroup_subsys_state *pos_css;
 
-	if (cs->css.cgroup->nr_populated_csets)
+	/*
+	 * We cannot call cs_is_populated(cs) directly, as
+	 * nr_populated_domain_children may include populated
+	 * csets from descendants that are partitions.
+	 */
+	if (cs->css.cgroup->nr_populated_csets ||
+	    cs->attach_in_progress)
 		return true;
 	if (!excluded_child && !cs->nr_subparts_cpus)
-		return cgroup_is_populated(cs->css.cgroup);
+		return cpuset_is_populated(cs);
 
 	rcu_read_lock();
-	cpuset_for_each_child(child, css, cs) {
-		if (child == excluded_child)
+	cpuset_for_each_descendant_pre(cp, pos_css, cs) {
+		if (cp == cs || cp == excluded_child)
 			continue;
-		if (is_partition_valid(child))
+
+		if (is_partition_valid(cp)) {
+			pos_css = css_rightmost_descendant(pos_css);
 			continue;
-		if (cgroup_is_populated(child->css.cgroup)) {
+		}
+
+		if (cpuset_is_populated(cp)) {
 			rcu_read_unlock();
 			return true;
 		}
@@ -751,7 +770,7 @@ static int validate_change(struct cpuset *cur, struct cpuset *trial)
 	 * be changed to have empty cpus_allowed or mems_allowed.
 	 */
 	ret = -ENOSPC;
-	if ((cgroup_is_populated(cur->css.cgroup) || cur->attach_in_progress)) {
+	if (cpuset_is_populated(cur)) {
 		if (!cpumask_empty(cur->cpus_allowed) &&
 		    cpumask_empty(trial->cpus_allowed))
 			goto out;
-- 
2.34.1

Re: [PATCH] cpuset: Treat cpusets in attaching as populated

[Chen Ridong]

On 2026/1/12 10:42, Chen Ridong wrote:
> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> 
> 6.6-stable review patch.  If anyone has any objections, please let me know.
> 
> ------------------
> 
> From: Chen Ridong <chenridong@huawei.com>
> 
> [ Upstream commit b1bcaed1e39a9e0dfbe324a15d2ca4253deda316 ]
> 
> Currently, the check for whether a partition is populated does not
> account for tasks in the cpuset of attaching. This is a corner case
> that can leave a task stuck in a partition with no effective CPUs.
> 
> The race condition occurs as follows:
> 
> cpu0				cpu1
> 				//cpuset A  with cpu N
> migrate task p to A
> cpuset_can_attach
> // with effective cpus
> // check ok
> 
> // cpuset_mutex is not held	// clear cpuset.cpus.exclusive
> 				// making effective cpus empty
> 				update_exclusive_cpumask
> 				// tasks_nocpu_error check ok
> 				// empty effective cpus, partition valid
> cpuset_attach
> ...
> // task p stays in A, with non-effective cpus.
> 
> To fix this issue, this patch introduces cs_is_populated, which considers
> tasks in the attaching cpuset. This new helper is used in validate_change
> and partition_is_populated.
> 
> Fixes: e2d59900d936 ("cgroup/cpuset: Allow no-task partition to have empty cpuset.cpus.effective")
> Signed-off-by: Chen Ridong <chenridong@huawei.com>
> Reviewed-by: Waiman Long <longman@redhat.com>
> Signed-off-by: Tejun Heo <tj@kernel.org>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
>  kernel/cgroup/cpuset.c | 37 ++++++++++++++++++++++++++++---------
>  1 file changed, 28 insertions(+), 9 deletions(-)
> 
> diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
> index eadb028916c8..3c466e742751 100644
> --- a/kernel/cgroup/cpuset.c
> +++ b/kernel/cgroup/cpuset.c
> @@ -453,6 +453,15 @@ static inline bool is_in_v2_mode(void)
>  	      (cpuset_cgrp_subsys.root->flags & CGRP_ROOT_CPUSET_V2_MODE);
>  }
>  
> +static inline bool cpuset_is_populated(struct cpuset *cs)
> +{
> +	lockdep_assert_held(&cpuset_mutex);
> +
> +	/* Cpusets in the process of attaching should be considered as populated */
> +	return cgroup_is_populated(cs->css.cgroup) ||
> +		cs->attach_in_progress;
> +}
> +
>  /**
>   * partition_is_populated - check if partition has tasks
>   * @cs: partition root to be checked
> @@ -465,21 +474,31 @@ static inline bool is_in_v2_mode(void)
>  static inline bool partition_is_populated(struct cpuset *cs,
>  					  struct cpuset *excluded_child)
>  {
> -	struct cgroup_subsys_state *css;
> -	struct cpuset *child;
> +	struct cpuset *cp;
> +	struct cgroup_subsys_state *pos_css;
>  
> -	if (cs->css.cgroup->nr_populated_csets)
> +	/*
> +	 * We cannot call cs_is_populated(cs) directly, as
> +	 * nr_populated_domain_children may include populated
> +	 * csets from descendants that are partitions.
> +	 */
> +	if (cs->css.cgroup->nr_populated_csets ||
> +	    cs->attach_in_progress)
>  		return true;
>  	if (!excluded_child && !cs->nr_subparts_cpus)
> -		return cgroup_is_populated(cs->css.cgroup);
> +		return cpuset_is_populated(cs);
>  

We should adjust this part to use cpuset_is_populated instead of cgroup_is_populated.

Thanks.

>  	rcu_read_lock();
> -	cpuset_for_each_child(child, css, cs) {
> -		if (child == excluded_child)
> +	cpuset_for_each_descendant_pre(cp, pos_css, cs) {
> +		if (cp == cs || cp == excluded_child)
>  			continue;
> -		if (is_partition_valid(child))
> +
> +		if (is_partition_valid(cp)) {
> +			pos_css = css_rightmost_descendant(pos_css);
>  			continue;
> -		if (cgroup_is_populated(child->css.cgroup)) {
> +		}
> +
> +		if (cpuset_is_populated(cp)) {
>  			rcu_read_unlock();
>  			return true;
>  		}
> @@ -751,7 +770,7 @@ static int validate_change(struct cpuset *cur, struct cpuset *trial)
>  	 * be changed to have empty cpus_allowed or mems_allowed.
>  	 */
>  	ret = -ENOSPC;
> -	if ((cgroup_is_populated(cur->css.cgroup) || cur->attach_in_progress)) {
> +	if (cpuset_is_populated(cur)) {
>  		if (!cpumask_empty(cur->cpus_allowed) &&
>  		    cpumask_empty(trial->cpus_allowed))
>  			goto out;

-- 
Best regards,
Ridong

Re: [PATCH] cpuset: Treat cpusets in attaching as populated

[Greg KH]

On Mon, Jan 12, 2026 at 02:42:57AM +0000, Chen Ridong wrote:
> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

I did not send this :(

> 6.6-stable review patch.  If anyone has any objections, please let me know.

This is already in the 6.6.120 release.

thanks,

greg k-h

Re: [PATCH] cpuset: Treat cpusets in attaching as populated

[Chen Ridong]

On 2026/1/12 14:42, Greg KH wrote:
> On Mon, Jan 12, 2026 at 02:42:57AM +0000, Chen Ridong wrote:
>> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> 
> I did not send this :(
> 
>> 6.6-stable review patch.  If anyone has any objections, please let me know.
> 
> This is already in the 6.6.120 release.
> 
> thanks,
> 
> greg k-h

I am sorry for the confusion.

I downloaded and modified the patch, and replied.

My point is that the patch intended for the 6.6.120 release should include an adaptation.
Specifically, the following block:

[...]
 	if (!excluded_child && !cs->nr_subparts_cpus)
 		return cgroup_is_populated(cs->css.cgroup);
[...]

Should be corrected to:

 	if (!excluded_child && !cs->nr_subparts_cpus)
-		return cgroup_is_populated(cs->css.cgroup);
+		return cpuset_is_populated(cs);

-- 
Best regards,
Ridong

Re: [PATCH] cpuset: Treat cpusets in attaching as populated

[Greg KH]

On Mon, Jan 12, 2026 at 02:55:53PM +0800, Chen Ridong wrote:
> 
> 
> On 2026/1/12 14:42, Greg KH wrote:
> > On Mon, Jan 12, 2026 at 02:42:57AM +0000, Chen Ridong wrote:
> >> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> > 
> > I did not send this :(
> > 
> >> 6.6-stable review patch.  If anyone has any objections, please let me know.
> > 
> > This is already in the 6.6.120 release.
> > 
> > thanks,
> > 
> > greg k-h
> 
> I am sorry for the confusion.
> 
> I downloaded and modified the patch, and replied.
> 
> My point is that the patch intended for the 6.6.120 release should include an adaptation.
> Specifically, the following block:
> 
> [...]
>  	if (!excluded_child && !cs->nr_subparts_cpus)
>  		return cgroup_is_populated(cs->css.cgroup);
> [...]
> 
> Should be corrected to:
> 
>  	if (!excluded_child && !cs->nr_subparts_cpus)
> -		return cgroup_is_populated(cs->css.cgroup);
> +		return cpuset_is_populated(cs);
> 

Great, can you send a fixup patch for this that we can apply to the next
release?

thanks,

greg k-h