From: Guopeng Zhang <zhangguopeng@kylinos.cn>

Widening an isolated child partition to include the last kernel-noise
housekeeping CPU invalidates the partition, but the CPU transfer
computed before the housekeeping check is still applied:

    WARNING: kernel/cgroup/cpuset.c:1315 at partition_xcpus_add+0x61/0x70, CPU#1: sh/1052
    Call Trace:
     <TASK>
     update_parent_effective_cpumask+0x320/0xa30
     cpuset_write_resmask+0x1e6/0x7c0
     </TASK>
    ---[ end trace 0000000000000000 ]---

This can be reproduced on a 32-CPU system booted with nohz_full=1:

    cd /sys/fs/cgroup
    echo +cpuset > cgroup.subtree_control
    mkdir A B C C/child
    echo 0 > A/cpuset.cpus
    echo isolated > A/cpuset.cpus.partition
    echo 4-31 > B/cpuset.cpus
    echo isolated > B/cpuset.cpus.partition
    echo +cpuset > C/cgroup.subtree_control
    echo 2-3 > C/cpuset.cpus
    echo root > C/cpuset.cpus.partition
    echo 3 > C/child/cpuset.cpus
    echo isolated > C/child/cpuset.cpus.partition
    echo 2-3 > C/child/cpuset.cpus

The last write returns 0 and leaves the hierarchy in this state:

    root (cpuset.cpus.effective=1)
    |
    +-- A (isolated):       cpuset.cpus=0
    |                       cpuset.cpus.effective=0
    +-- B (isolated):       cpuset.cpus=4-31
    |                       cpuset.cpus.effective=4-31
    \-- C (root):           cpuset.cpus=2-3
        |                   cpuset.cpus.effective=<empty>
        \-- C/child (invalid isolated):
                            cpuset.cpus=2-3
                            cpuset.cpus.effective=<empty>

Before the last write, C owns CPU 2 and C/child owns CPU 3. The last
write changes C/child's CPU mask from 3 to 2-3, which would transfer
CPU 2 from C to C/child.

The housekeeping check invalidates C/child, but delmask still contains
CPU 2 while addmask is empty. partition_xcpus_add() therefore removes
CPU 2 from C and warns because the new partition state is invalid.
CPU 3 is not returned when C/child is invalidated, leaving both CPUs
unavailable to any valid partition.

Handle PERR_HKEEPING like PERR_NOCPUS: cancel the pending transfer and
rebuild addmask from the CPUs currently held by the child. This leaves
CPU 2 in C and returns CPU 3 to C.

Fixes: 103b08709e8a ("cgroup/cpuset: Fail if isolated and nohz_full don't leave any housekeeping")
Signed-off-by: Guopeng Zhang <zhangguopeng@kylinos.cn>
---
 kernel/cgroup/cpuset.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
index 753aa65afcd7..a4ead0d3c872 100644
--- a/kernel/cgroup/cpuset.c
+++ b/kernel/cgroup/cpuset.c
@@ -1929,6 +1929,17 @@ static int update_parent_effective_cpumask(struct cpuset *cs, int cmd,
 			    /* Adding to parent means adding isolated CPUs */
 			    !isolated_cpus_can_update(tmp->addmask, tmp->delmask))
 				part_error = PERR_HKEEPING;
+			if (part_error == PERR_HKEEPING) {
+				/*
+				 * Fall back to returning all the granted
+				 * CPUs to the parent instead of applying
+				 * the pending change.
+				 */
+				deleting = false;
+				adding = cpumask_and(tmp->addmask,
+						     cs->effective_xcpus,
+						     parent->effective_xcpus);
+			}
 		}
 
 		/*
-- 
2.43.0