In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
cgroup\/cpuset: Return PERR_NOCPUS in remote_partition_enable() on subpartitions_cpus conflict<\/p>\n
When a remote partition is created underneath an existing local partition
\nvia a non-partition (PRS_MEMBER) intermediate cgroup, update_prstate() sees
\nparent->partition_root_state == PRS_MEMBER and calls
\nremote_partition_enable().<\/p>\n
Commit 86888c7bd117 (“cgroup\/cpuset: Add warnings to catch inconsistency
\nin exclusive CPUs”) replaced the cpumask_intersects(tmp->new_cpus,
\nsubpartitions_cpus) error check in remote_partition_enable() with
\nWARN_ON_ONCE(). As a result, remote_partition_enable() emits a warning
\nand proceeds to enable the remote partition on CPUs that are already
\nowned by the ancestor local partition in subpartitions_cpus.<\/p>\n
This can be reproduced on Linux 7.3.0-rc3 with:<\/p>\n
mkdir -p \/tmp\/cg1
\n mount -t cgroup2 none \/tmp\/cg1
\n echo “+cpuset” > \/tmp\/cg1\/cgroup.subtree_control<\/p>\n
mkdir \/tmp\/cg1\/A
\n echo 1 > \/tmp\/cg1\/A\/cpuset.cpus
\n echo 1 > \/tmp\/cg1\/A\/cpuset.cpus.exclusive
\n echo root > \/tmp\/cg1\/A\/cpuset.cpus.partition
\n echo “+cpuset” > \/tmp\/cg1\/A\/cgroup.subtree_control<\/p>\n
mkdir \/tmp\/cg1\/A\/B
\n echo 1 > \/tmp\/cg1\/A\/B\/cpuset.cpus
\n echo 1 > \/tmp\/cg1\/A\/B\/cpuset.cpus.exclusive
\n echo “+cpuset” > \/tmp\/cg1\/A\/B\/cgroup.subtree_control<\/p>\n
mkdir \/tmp\/cg1\/A\/B\/D
\n echo 1 > \/tmp\/cg1\/A\/B\/D\/cpuset.cpus
\n echo 1 > \/tmp\/cg1\/A\/B\/D\/cpuset.cpus.exclusive
\n echo root > \/tmp\/cg1\/A\/B\/D\/cpuset.cpus.partition<\/p>\n
which triggers:<\/p>\n
WARNING: kernel\/cgroup\/cpuset.c:1594 at remote_partition_enable+0x1c1\/0x300<\/p>\n
and leaves both \/tmp\/cg1\/A and \/tmp\/cg1\/A\/B\/D as active root partitions
\nclaiming exclusive CPU 1.<\/p>\n
Fix this by returning PERR_NOCPUS when tmp->new_cpus intersects
\nsubpartitions_cpus in remote_partition_enable(), matching the error code
\nused by remote_cpus_update() for the same subpartitions_cpus conflict, and
\nadd a regression test case to
\ntools\/testing\/selftests\/cgroup\/test_cpuset_prs.sh.<\/p>\n
Tested in QEMU on Linux 7.3.0-rc3 using the reproducer above and
\ntools\/testing\/selftests\/cgroup\/test_cpuset_prs.sh.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
cgroup\/cpuset: Return PERR_NOCPUS in remote_partition_enable() on subpartitions_cpus conflict<\/p>\n
When a remote partition is created u<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41014","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41014","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41014"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41014"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41014"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}