With cgroup v2 migration of a multithreaded process having threads in different cgroups of a threaded subtree, it is possible that cpuset_can_attach() can be called with tasks that are not migrating with respect to cpuset if cpuset controller is not enabled in some of the subtree cgroups. IOW, the old cpuset can be the same as the new one. This can cause problem when we need to track the set of old cpusets and the new cpusets in singly linked lists as a cpuset cannot be in both lists.
As reported by Tejun, the following is an example threaded subtree with partial cpuset delegation that can cause this issue to show up. P (+cpuset) |- R (cpuset) <- destination | `- C (no cpuset) -> effective cpuset == R `- W (cpuset) Group leader in R, thread_a in C, thread_b in W; migrate the whole process into R (echo $PID > R/cgroup.procs). thread_a moves C->R: its cgroup changes so compare_css_sets() keeps it in the taskset, but its cpuset css is unchanged (C inherits R's), so task_cs() == cs == R. cpuset is in ss_mask because thread_b (W->R) changed. can_attach() then tags R as a source (thread_a) and the destination (thread_b): Handle this special case by skipping tasks that are not migrating in cpuset_can_attach() and avoid calling cpuset_can_attach_check() in this case. By doing so, the destination cpuset will not be put into source cpuset linked list. As the source cpuset cannot be easily determined in cpuset_attach(), unnecessary work can be performed if a task is not actually migrating. However, no harm will be done except wasting some CPU cycles. If it happens that none of the tasks is migrating, attach_ctx.old_cs will be NULL and task iteration won't be needed. Reported-by: Tejun Heo <[email protected]> Closes: https://lore.kernel.org/lkml/[email protected] Signed-off-by: Waiman Long <[email protected]> --- kernel/cgroup/cpuset.c | 34 +++++++++++++++++++++++----------- 1 file changed, 23 insertions(+), 11 deletions(-) diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c index a95cc0040101..d46590c05173 100644 --- a/kernel/cgroup/cpuset.c +++ b/kernel/cgroup/cpuset.c @@ -3139,21 +3139,13 @@ static int cpuset_can_attach(struct cgroup_taskset *tset) bool setsched_check; int ret; - /* used later by cpuset_attach() */ - attach_ctx.old_cs = task_cs(cgroup_taskset_first(tset, &css)); - oldcs = attach_ctx.old_cs; - cs = css_cs(css); - + cs = oldcs = NULL; mutex_lock(&cpuset_mutex); + attach_ctx.old_cs = NULL; /* Used later in cpuset_attach_task() */ attach_ctx.cpus_updated = false; attach_ctx.mems_updated = false; attach_ctx.many_dest_cs = false; - /* Check to see if task is allowed in the cpuset */ - ret = cpuset_can_attach_check(cs, oldcs, &setsched_check); - if (ret) - goto out_unlock; - /* * The attach_ctx.old_cs is used mainly by cpuset_migrate_mm() to get * the old_mems_allowed value. There are two ways that many-to-one @@ -3170,21 +3162,33 @@ static int cpuset_can_attach(struct cgroup_taskset *tset) * of child cpusets must always be a subset of the parent. So no real * page migration will be necessary no matter which child cpuset is * selected as attach_ctx.old_cs. + * + * For a v2 threaded subtree where cpuset isn't enabled in some of the + * cgroups, it is possible that oldcs == cs for some of the tasks. + * In this case, we can skip checking on those tasks as there is no + * actual migration wrt cpuset. */ cgroup_taskset_for_each(task, css, tset) { struct cpuset *new_cs = css_cs(css); struct cpuset *new_oldcs = task_cs(task); if ((new_oldcs != oldcs) || (new_cs != cs)) { - if (new_cs != cs) + if (cs && (new_cs != cs)) attach_ctx.many_dest_cs = true; cs = new_cs; oldcs = new_oldcs; + if (oldcs == cs) + continue; + if (!attach_ctx.old_cs) + attach_ctx.old_cs = oldcs; ret = cpuset_can_attach_check(cs, oldcs, &setsched_check); if (ret) goto out_unlock; } + if (oldcs == cs) + continue; + ret = task_can_attach(task); if (ret) goto out_unlock; @@ -3326,6 +3330,14 @@ static void cpuset_attach(struct cgroup_taskset *tset) attach_ctx.task_work_queued = false; guarantee_online_mems(cs, &attach_ctx.nodemask_to); + /* + * attach_ctx.old_cs can only be NULL if no task is actually migrating. + * This is highly unlikely. If it happens at all, we can skip task + * iteration and setting old_mems_allowed. + */ + if (unlikely(!attach_ctx.old_cs)) + goto out; + /* * In the default hierarchy, enabling cpuset in the child cgroups * will trigger a cpuset_attach() call with no change in effective cpus -- 2.55.0
