From patchwork Thu Jan 3 03:54:26 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrei Vagin X-Patchwork-Id: 10746933 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 6FD9B746 for ; Thu, 3 Jan 2019 03:54:35 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 5510827F82 for ; Thu, 3 Jan 2019 03:54:35 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 471B3287AF; Thu, 3 Jan 2019 03:54:35 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FROM,MAILING_LIST_MULTI,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id D672427F82 for ; Thu, 3 Jan 2019 03:54:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728645AbfACDyd (ORCPT ); Wed, 2 Jan 2019 22:54:33 -0500 Received: from mail-pl1-f194.google.com ([209.85.214.194]:33493 "EHLO mail-pl1-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726136AbfACDyd (ORCPT ); Wed, 2 Jan 2019 22:54:33 -0500 Received: by mail-pl1-f194.google.com with SMTP id z23so15341891plo.0; Wed, 02 Jan 2019 19:54:33 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=K87qvoRYYTTlvpNAo971hRDWjE/SlfHuyXck0+hnVMU=; b=elLuNoYwa1HENSh/6OFtPgNMzTl5wX+oINNZw1u9pIWQ5drIyaRAwAzKE8zIPR/Bwg 337OOYK9nFOv3ziqwzLiZoJRxW5+uqtA1nRNGhzzKjRjyKdFAf7SlBlbNulkZH+8iFB9 IwQ32TImxhyqXP60TSPdBQk7YRnQuh2s7da90AIjlN8kTT0CocAGJKvQqCjGJ2vX6iBo /nG3WW8mdSdYekFeSoPvx7WOHnpYEq/qZHkcTkAcGN8mgnQrcS/7OOkCxSbz/UbZCEBD 8s6tdBtt6xfFl4dsEHkzs6UG8LymnXk5EqpEPRKHEjLvb3Qi6q34hQVsvWJ7OCpfB7PG Hq5Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=K87qvoRYYTTlvpNAo971hRDWjE/SlfHuyXck0+hnVMU=; b=s9j3GDM6Vt0gRhIP0ToDXbqlLmjNzJ6I61A/0H+PXVQaX9abKaaIxMbtuWS7gnJqk6 M3lX1xBe8s8Kwan8GRvux+hpDGGPBe4793w2hRSCMBxhfXLd+1tFH2dUKcgCU1zU2ZVk QjPAnTb/2h9hxLkBhOGbCNXL4FQhzIW+eY3Ku1mn71mmkaqPzNmMBsbdDBuJ4Dtr/80j kUKrXMLtDYAe0zZEptun3iVBXhm21IHwzbjIlVV2M4URtKARNxaolhuwNtDtz5jtGuyK 7WiQOwROnunqM7H10k0DNdS+oF8CN2TnDCtYQVsuZd3GjaNurqEsSM4qAAz37UmHd1gL mVog== X-Gm-Message-State: AJcUukerqCDWonO8YdDoggrcNlt+2hRrVX+X7VuoFhtobaahUBqbq142 5pWnckTxBIZ5rFIm8bPBTcU1VHHJ X-Google-Smtp-Source: ALg8bN6ivlD5SU8R293Y1GUiRc8mWqQNVzQLBF0lllwwHuJLlnojMhOmqZ0J33CStkoN9Yk3QqFCZQ== X-Received: by 2002:a17:902:bb86:: with SMTP id m6mr46355149pls.315.1546487672478; Wed, 02 Jan 2019 19:54:32 -0800 (PST) Received: from localhost.localdomain (c-73-140-212-29.hsd1.wa.comcast.net. [73.140.212.29]) by smtp.gmail.com with ESMTPSA id 202sm107531656pfy.87.2019.01.02.19.54.31 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Wed, 02 Jan 2019 19:54:31 -0800 (PST) From: Andrei Vagin To: Alexander Viro , David Howells Cc: linux-fsdevel@vger.kernel.org, cgroups@vger.kernel.org, Andrei Vagin , Li Zefan Subject: [PATCH vfs/for-next v6] cgroup: fix top cgroup refcnt leak Date: Wed, 2 Jan 2019 19:54:26 -0800 Message-Id: <20190103035426.23526-1-avagin@gmail.com> X-Mailer: git-send-email 2.17.2 In-Reply-To: <20190103010000.GA32003@gmail.com> References: <20190103010000.GA32003@gmail.com> Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP It looks like the c6b3d5bcd67c ("cgroup: fix top cgroup refcnt leak") commit was reverted by mistake. $ mkdir /tmp/cgroup $ mkdir /tmp/cgroup2 $ mount -t cgroup -o none,name=test test /tmp/cgroup $ mount -t cgroup -o none,name=test test /tmp/cgroup2 $ umount /tmp/cgroup $ umount /tmp/cgroup2 $ cat /proc/self/cgroup | grep test 12:name=test:/ You can see the test cgroup was not freed. Cc: Li Zefan Fixes: aea3f2676c83 ("kernfs, sysfs, cgroup, intel_rdt: Support fs_context") Signed-off-by: Andrei Vagin --- v2: clean up code and add the vfs/for-next tag v3: fix a reference leak when kernfs_node_dentry fails v4: call deactivate_locked_super() in a error case v5: don't dereference fc->root after dput() v6: rebase on today's vfs/for-next kernel/cgroup/cgroup-v1.c | 2 +- kernel/cgroup/cgroup.c | 25 ++++++++++++++++++------- 2 files changed, 19 insertions(+), 8 deletions(-) diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c index 4b189e821cad..de7d625ec077 100644 --- a/kernel/cgroup/cgroup-v1.c +++ b/kernel/cgroup/cgroup-v1.c @@ -1285,8 +1285,8 @@ int cgroup1_get_tree(struct fs_context *fc) mutex_lock(&cgroup_mutex); percpu_ref_reinit(&root->cgrp.self.refcnt); mutex_unlock(&cgroup_mutex); - cgroup_get(&root->cgrp); } + cgroup_get(&root->cgrp); /* * If @pinned_sb, we're reusing an existing root and holding an diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c index a19f0fec9d82..fe67b5e81f9a 100644 --- a/kernel/cgroup/cgroup.c +++ b/kernel/cgroup/cgroup.c @@ -2019,7 +2019,7 @@ int cgroup_do_get_tree(struct fs_context *fc) ret = kernfs_get_tree(fc); if (ret < 0) - goto out_cgrp; + return ret; /* * In non-init cgroup namespace, instead of root cgroup's dentry, @@ -2038,19 +2038,30 @@ int cgroup_do_get_tree(struct fs_context *fc) mutex_unlock(&cgroup_mutex); nsdentry = kernfs_node_dentry(cgrp->kn, fc->root->d_sb); - if (IS_ERR(nsdentry)) - return PTR_ERR(nsdentry); + if (IS_ERR(nsdentry)) { + ret = PTR_ERR(nsdentry); + goto out_cgrp; + } dput(fc->root); fc->root = nsdentry; } ret = 0; - if (ctx->kfc.new_sb_created) - goto out_cgrp; - apply_cgroup_root_flags(ctx->flags); - return 0; + if (!ctx->kfc.new_sb_created) + apply_cgroup_root_flags(ctx->flags); out_cgrp: + if (!ctx->kfc.new_sb_created) + cgroup_put(&ctx->root->cgrp); + + if (unlikely(ret)) { + struct super_block *sb = fc->root->d_sb; + + dput(fc->root); + deactivate_locked_super(sb); + fc->root = NULL; + } + return ret; }