Commit 089f3fcd690c for kernel

commit 089f3fcd690c71cb3d8ca09f34027764e28920a0
Author: Waiman Long <longman@redhat.com>
Date:   Tue Mar 31 11:11:08 2026 -0400

    cgroup/cpuset: Skip security check for hotplug induced v1 task migration

    When a CPU hot removal causes a v1 cpuset to lose all its CPUs, the
    cpuset hotplug handler will schedule a work function to migrate tasks
    in that cpuset with no CPU to its ancestor to enable those tasks to
    continue running.

    If a strict security policy is in place, however, the task migration
    may fail when security_task_setscheduler() call in cpuset_can_attach()
    returns a -EACCES error. That will mean that those tasks will have
    no CPU to run on. The system administrators will have to explicitly
    intervene to either add CPUs to that cpuset or move the tasks elsewhere
    if they are aware of it.

    This problem was found by a reported test failure in the LTP's
    cpuset_hotplug_test.sh. Fix this problem by treating this special case as
    an exception to skip the setsched security check in cpuset_can_attach()
    when a v1 cpuset with tasks have no CPU left.

    With that patch applied, the cpuset_hotplug_test.sh test can be run
    successfully without failure.

    Signed-off-by: Waiman Long <longman@redhat.com>
    Signed-off-by: Tejun Heo <tj@kernel.org>

diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
index 58c5b7b72cca..1335e437098e 100644
--- a/kernel/cgroup/cpuset.c
+++ b/kernel/cgroup/cpuset.c
@@ -3012,6 +3012,16 @@ static int cpuset_can_attach(struct cgroup_taskset *tset)
 		!cpumask_equal(cs->effective_cpus, oldcs->effective_cpus) ||
 		!nodes_equal(cs->effective_mems, oldcs->effective_mems);

+	/*
+	 * A v1 cpuset with tasks will have no CPU left only when CPU hotplug
+	 * brings the last online CPU offline as users are not allowed to empty
+	 * cpuset.cpus when there are active tasks inside. When that happens,
+	 * we should allow tasks to migrate out without security check to make
+	 * sure they will be able to run after migration.
+	 */
+	if (!is_in_v2_mode() && cpumask_empty(oldcs->effective_cpus))
+		setsched_check = false;
+
 	cgroup_taskset_for_each(task, css, tset) {
 		ret = task_can_attach(task);
 		if (ret)