Mainline commit 4a39eda5fdd8 ("cgroup/cpuset: Reset DL migration state
on can_attach() failure") puts the common error cleanup in
cpuset_can_attach().  The 6.6.y backport instead placed that hunk at
cpuset_can_fork()'s similarly named out_unlock label, while removing
cpuset_can_attach()'s two existing targeted resets.

If cpuset_can_attach() fails after accounting a SCHED_DEADLINE task,
cgroup_migrate_execute() does not call cpuset_cancel_attach() for the
failing subsystem.  The temporary migration fields remain set, and a
later successful migration can consume the stale state and corrupt
deadline-task and pending-bandwidth accounting.

Move the reset to cpuset_can_attach()'s common error exit.  It is not
needed in cpuset_can_fork(), which never accumulates migration DL state.

Fixes: 14897ef9341c ("cgroup/cpuset: Reset DL migration state on can_attach() failure")
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
---
Applies to Linux 6.6.155 and 6.6.156-rc1.

A controlled QEMU A/B on 6.6.155 forced an attach error after accounting a
real SCHED_DEADLINE task.  The affected kernel returned with
nr_migrate_dl_tasks=1 and sum_migrate_dl_bw=104857; both fields were zero
with this patch.

The equivalent 6.1.y correction is submitted separately.

 kernel/cgroup/cpuset.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
index f9c7178f51ada..bb413045d1744 100644
--- a/kernel/cgroup/cpuset.c
+++ b/kernel/cgroup/cpuset.c
@@ -2630,6 +2630,8 @@ static int cpuset_can_attach(struct cgroup_taskset *tset)
 	 */
 	cs->attach_in_progress++;
 out_unlock:
+	if (ret)
+		reset_migrate_dl_data(cs);
 	mutex_unlock(&cpuset_mutex);
 	return ret;
 }
@@ -3462,8 +3464,6 @@ static int cpuset_can_fork(struct task_struct *task, struct css_set *cset)
 	cs->attach_in_progress++;
 
 out_unlock:
-	if (ret)
-		reset_migrate_dl_data(cs);
 	mutex_unlock(&cpuset_mutex);
 	return ret;
 }
-- 
2.53.0

在 2026/9/1 20:26, Karl Mehltretter 写道:
> Mainline commit 4a39eda5fdd8 ("cgroup/cpuset: Reset DL migration state
> on can_attach() failure") puts the common error cleanup in
> cpuset_can_attach().  The 6.6.y backport instead placed that hunk at
> cpuset_can_fork()'s similarly named out_unlock label, while removing
> cpuset_can_attach()'s two existing targeted resets.
> 
> If cpuset_can_attach() fails after accounting a SCHED_DEADLINE task,
> cgroup_migrate_execute() does not call cpuset_cancel_attach() for the
> failing subsystem.  The temporary migration fields remain set, and a
> later successful migration can consume the stale state and corrupt
> deadline-task and pending-bandwidth accounting.
> 
> Move the reset to cpuset_can_attach()'s common error exit.  It is not
> needed in cpuset_can_fork(), which never accumulates migration DL state.
> 
> Fixes: 14897ef9341c ("cgroup/cpuset: Reset DL migration state on can_attach() failure")
> Assisted-by: LLM
> Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
> ---
> Applies to Linux 6.6.155 and 6.6.156-rc1.
> 
> A controlled QEMU A/B on 6.6.155 forced an attach error after accounting a
> real SCHED_DEADLINE task.  The affected kernel returned with
> nr_migrate_dl_tasks=1 and sum_migrate_dl_bw=104857; both fields were zero
> with this patch.
> 
> The equivalent 6.1.y correction is submitted separately.
> 
>  kernel/cgroup/cpuset.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
> index f9c7178f51ada..bb413045d1744 100644
> --- a/kernel/cgroup/cpuset.c
> +++ b/kernel/cgroup/cpuset.c
> @@ -2630,6 +2630,8 @@ static int cpuset_can_attach(struct cgroup_taskset *tset)
>  	 */
>  	cs->attach_in_progress++;
>  out_unlock:
> +	if (ret)
> +		reset_migrate_dl_data(cs);
>  	mutex_unlock(&cpuset_mutex);
>  	return ret;
>  }
> @@ -3462,8 +3464,6 @@ static int cpuset_can_fork(struct task_struct *task, struct css_set *cset)
>  	cs->attach_in_progress++;
>  
>  out_unlock:
> -	if (ret)
> -		reset_migrate_dl_data(cs);
>  	mutex_unlock(&cpuset_mutex);
>  	return ret;
>  }

Acked-by: Guopeng Zhang <zhangguopeng@kylinos.cn>

> Mainline commit 4a39eda5fdd8 ("cgroup/cpuset: Reset DL migration state
> on can_attach() failure") puts the common error cleanup in
> cpuset_can_attach(). The 6.6.y backport instead placed that hunk at
> cpuset_can_fork()'s similarly named out_unlock label, while removing
> cpuset_can_attach()'s two existing targeted resets.

Same like the other mail, maintainer ack will be great.

-- 
Thanks,
Sasha