Skip to content

runsc/cgroup: fix systemd cpuset byte order#13251

Open
mrgalaxy-source wants to merge 1 commit into
google:masterfrom
mrgalaxy-source:mrgalaxy/endianfix
Open

runsc/cgroup: fix systemd cpuset byte order#13251
mrgalaxy-source wants to merge 1 commit into
google:masterfrom
mrgalaxy-source:mrgalaxy/endianfix

Conversation

@mrgalaxy-source
Copy link
Copy Markdown

@mrgalaxy-source mrgalaxy-source commented May 22, 2026

RangeToBits builds a cgroup v2 CPU or memory-node mask with big.Int, then passes big.Int.Bytes to systemd as AllowedCPUs/AllowedMemoryNodes. big.Int returns bytes in big-endian order, while systemd expects byte 0 to describe IDs 0-7, byte 1 to describe IDs 8-15, and so on.

This reverses multi-byte masks when Docker/containerd asks runsc to create a systemd transient scope. For example, an OCI cpuset of "8,184" can be applied as CPUs "0,176".

Reverse the generated byte slice before returning it and add a regression test that spans enough bytes to catch the lane reversal.

Here are a couple of related issues that "tipped us off" to this being the problem:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1076814
opencontainers/runc@77cae9a

Assisted-by: OpenAI Codex

Signed-off-by: Michael Galaxy mrgalaxy@nvidia.com

RangeToBits builds a cgroup v2 CPU or memory-node mask with big.Int,
then passes big.Int.Bytes to systemd as AllowedCPUs/AllowedMemoryNodes.
big.Int returns bytes in big-endian order, while systemd expects byte 0
to describe IDs 0-7, byte 1 to describe IDs 8-15, and so on.

This reverses multi-byte masks when Docker/containerd asks runsc to
create a systemd transient scope. For example, an OCI cpuset of "8,184"
can be applied as CPUs "0,176".

Reverse the generated byte slice before returning it and add a
regression test that spans enough bytes to catch the lane reversal.

Assisted-by: OpenAI Codex

Signed-off-by: Michael Galaxy <mrgalaxy@nvidia.com>
@google-cla
Copy link
Copy Markdown

google-cla Bot commented May 22, 2026

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

@ayushr2 ayushr2 requested a review from manninglucas May 22, 2026 21:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant