Commit 1f1562fc authored Dec 05, 2021 by Waiman Long Committed by Tejun Heo Dec 13, 2021

cgroup/cpuset: Don't let child cpusets restrict parent in default hierarchy



In validate_change(), there is a check since v2.6.12 to make sure that
each of the child cpusets must be a subset of a parent cpuset.  IOW, it
allows child cpusets to restrict what changes can be made to a parent's
"cpuset.cpus". This actually violates one of the core principles of the
default hierarchy where a cgroup higher up in the hierarchy should be
able to change configuration however it sees fit as deligation breaks
down otherwise.

To address this issue, the check is now removed for the default hierarchy
to free parent cpusets from being restricted by child cpusets. The
check will still apply for legacy hierarchy.

Suggested-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Waiman Long <longman@redhat.com>
Signed-off-by: Tejun Heo <tj@kernel.org>

parent e14da771

kernel/cgroup/cpuset.c

+3 −11

Original line number	Diff line number	Diff line
		@@ -616,19 +616,11 @@ static int validate_change(struct cpuset cur, struct cpuset trial)
		struct cpuset c, par;
		int ret;

		rcu_read_lock();

		/* Each of our child cpusets must be a subset of us */
		ret = -EBUSY;
		cpuset_for_each_child(c, css, cur)
		if (!is_cpuset_subset(c, trial))
		goto out;

		/* Remaining checks don't apply to root cpuset */
		ret = 0;
		/* The checks don't apply to root cpuset */
		if (cur == &top_cpuset)
		goto out;
		return 0;

		rcu_read_lock();
		par = parent_cs(cur);

		/* On legacy hierarchy, we must be a subset of our parent cpuset. */