fix slice sharing bug in cgroup manager

pkg/kubelet/cm/cgroup_manager_linux.go

@@ -67,7 +67,10 @@ func NewCgroupName(base CgroupName, components ...string) CgroupName {
 			panic(fmt.Errorf("invalid character in component [%q] of CgroupName", component))
 		}
 	}
-	return CgroupName(append(base, components...))
+	// copy data from the base cgroup to eliminate cases where CgroupNames share underlying slices.  See #68416
+	baseCopy := make([]string, len(base))
+	copy(baseCopy, base)
+	return CgroupName(append(baseCopy, components...))
 }
 
 func escapeSystemdCgroupName(part string) string {

pkg/kubelet/cm/cgroup_manager_linux_test.go

@@ -20,9 +20,34 @@ package cm
 
 import (
 	"path"
+	"reflect"
 	"testing"
 )
 
+// TestNewCgroupName tests confirms that #68416 is fixed
+func TestNewCgroupName(t *testing.T) {
+	a := ParseCgroupfsToCgroupName("/a/")
+	ab := NewCgroupName(a, "b")
+
+	expectedAB := CgroupName([]string{"a", "", "b"})
+	if !reflect.DeepEqual(ab, expectedAB) {
+		t.Errorf("Expected %d%+v; got %d%+v", len(expectedAB), expectedAB, len(ab), ab)
+	}
+
+	abc := NewCgroupName(ab, "c")
+
+	expectedABC := CgroupName([]string{"a", "", "b", "c"})
+	if !reflect.DeepEqual(abc, expectedABC) {
+		t.Errorf("Expected %d%+v; got %d%+v", len(expectedABC), expectedABC, len(abc), abc)
+	}
+
+	_ = NewCgroupName(ab, "d")
+
+	if !reflect.DeepEqual(abc, expectedABC) {
+		t.Errorf("Expected %d%+v; got %d%+v", len(expectedABC), expectedABC, len(abc), abc)
+	}
+}
+
 func TestCgroupNameToSystemdBasename(t *testing.T) {
 	testCases := []struct {
 		input    CgroupName