From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A447A4582C1; Tue, 21 Jul 2026 22:24:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784672664; cv=none; b=lhVEHk2LOIsksj0oXQoyEEBe+qT72BYj3yKseuLTmipYW47KFdvdbRVK46NBY/tgFGZWtQJon+qTcSJesbeuAHJFTspSOYoRgqfh/gCnQ1kvIIfXovbfYkB8icuek4nuh6bU01f5e15ZJX70S4vkhcPQk5THRH0g/oY2pK0eENc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784672664; c=relaxed/simple; bh=3wItF5Bnl7gZdaycHKJWXH28pKnsnqoLqxvJlYlsUT8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=K9CUo+MMqDFI6Nx5XoXVg/HWHqfWhiVMGEqTBmcltk96V4FizE28L2+2JalGNzAREggXDuz8i91gk6rYzd4UqcIAkwRKptyjSe1Fle4/xRZYbbiSVSinqib4/Nv9mA8dlPJ88wEre0G+bNvzFasd5wKQjGGpyjc1rC5ziHQtcC0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=CCNPprQG; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="CCNPprQG" Received: by smtp.kernel.org (Postfix) with ESMTPSA id DA6901F000E9; Tue, 21 Jul 2026 22:24:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1784672663; bh=5y+sEdMrN5ZdC5bQ/iTQpvaj4cMGWNwts/cfz9FjoBc=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=CCNPprQGp878C0sIewo5Ke4HIsTYcIyw9gNCb4ER1XbGasApRp2hJIXrKlMh0rjOq n0lsxQhDM6YAnvRpH/rg44Srxa1M6aArEwvR0pyKgRLuAYohK5HEMUn31YJNjDi+/1 iin4cTMazvqL0EVPHiip9VFzsswrmgJd4DbOAqHQ= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Gregory Price , Waiman Long , Farhad Alemi , Andrew Morton , Alistair Popple , Byungchul Park , "Huang, Ying" , Joshua Hahn , Matthew Brost , Rakie Kim , Rasmus Villemoes , Zi Yan , Tejun Heo , Ridong Chen , Johannes Weiner , =?UTF-8?q?Michal=20Koutn=C3=BD?= , "David Hildenbrand (Arm)" Subject: [PATCH 5.15 709/843] cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed Date: Tue, 21 Jul 2026 17:25:44 +0200 Message-ID: <20260721152421.999810886@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260721152405.946368001@linuxfoundation.org> References: <20260721152405.946368001@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 5.15-stable review patch. If anyone has any objections, please let me know. ------------------ From: Farhad Alemi commit b983c56426383e4a06fa5970c4e33cee879b1482 upstream. Creating a child cpuset where cpuset.mems is never set leads to a div/0 when a VMA mempolicy with MPOL_F_RELATIVE_NODES rebinds in response to a CPU hotplug event. Reproduction steps: 1) Create a cgroup w/ cpuset controls (do not set cpuset.mems) 2) Move the task into the child cpuset 3) Create a VMA mempolicy for that task with MPOL_F_RELATIVE_NODES 4) unplug and hotplug a cpu echo 0 > /sys/devices/system/cpu/cpu1/online echo 1 > /sys/devices/system/cpu/cpu1/online 5) mempolicy rebind does a div/0 in mpol_relative_nodemask on the call to __nodes_fold() The cpuset code passes (cs->mems_allowed) which is not guaranteed to have nodes to the rebind routine. Use cs->effective_mems instead, which is guaranteed to have a non-empty nodemask once we reach that code path. Link: https://lore.kernel.org/all/CA+0ovCiEz6SP_sn3kN4Tb+_oC=eHMXy_Ffj=usV3wREdQrUtww@mail.gmail.com/ Fixes: ae1c802382f7 ("cpuset: apply cs->effective_{cpus,mems}") Closes: https://lore.kernel.org/linux-mm/CA+0ovCgxbZkXa+OU8w3s84R3KNPNxxRfmsNR-udh+afQBbGNmw@mail.gmail.com/ Suggested-by: Gregory Price Suggested-by: Waiman Long Acked-by: Waiman Long Signed-off-by: Farhad Alemi Cc: Andrew Morton Cc: Alistair Popple Cc: Byungchul Park Cc: Gregory Price Cc: "Huang, Ying" Cc: Joshua Hahn Cc: Matthew Brost Cc: Rakie Kim Cc: Rasmus Villemoes Cc: Zi Yan Cc: Tejun Heo Cc: Ridong Chen Cc: Johannes Weiner Cc: "Michal Koutný" Cc: [ david: add a comment, slightly rephrase description ] Signed-off-by: David Hildenbrand (Arm) Signed-off-by: Tejun Heo Signed-off-by: Greg Kroah-Hartman --- kernel/cgroup/cpuset.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) --- a/kernel/cgroup/cpuset.c +++ b/kernel/cgroup/cpuset.c @@ -1805,7 +1805,12 @@ static void update_tasks_nodemask(struct migrate = is_memory_migrate(cs); - mpol_rebind_mm(mm, &cs->mems_allowed); + /* + * For v1 we can have empty effective_mems, but we cannot + * attach any tasks (see cpuset_can_attach_check()). For v2, + * effective_mems is guaranteed to not be empty. + */ + mpol_rebind_mm(mm, &cs->effective_mems); if (migrate) cpuset_migrate_mm(mm, &cs->old_mems_allowed, &newmems); else