Commit 399504e2 authored by Al Viro's avatar Al Viro
Browse files

fix cgroup_do_mount() handling of failure exits 



same story as with last May fixes in sysfs (7b745a4e
"unfuck sysfs_mount()"); new_sb is left uninitialized
in case of early errors in kernfs_mount_ns() and papering
over it by treating any error from kernfs_mount_ns() as
equivalent to !new_ns ends up conflating the cases when
objects had never been transferred to a superblock with
ones when that has happened and resulting new superblock
had been dropped.  Easily fixed (same way as in sysfs
case).  Additionally, there's a superblock leak on
kernfs_node_dentry() failure *and* a dentry leak inside
kernfs_node_dentry() itself - the latter on probably
impossible errors, but the former not impossible to trigger
(as the matter of fact, injecting allocation failures
at that point *does* trigger it).

Cc: stable@kernel.org
Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent 1c7fc5cb

fs/kernfs/mount.c

+6 −2
Original line number Diff line number Diff line
@@ -196,8 +196,10 @@ struct dentry *kernfs_node_dentry(struct kernfs_node *kn, 
		return dentry;



	knparent = find_next_ancestor(kn, NULL);

	if (WARN_ON(!knparent))

	if (WARN_ON(!knparent)) {

		dput(dentry);

		return ERR_PTR(-EINVAL);

	}



	do {

		struct dentry *dtmp;
@@ -206,8 +208,10 @@ struct dentry *kernfs_node_dentry(struct kernfs_node *kn, 
		if (kn == knparent)

			return dentry;

		kntmp = find_next_ancestor(kn, knparent);

		if (WARN_ON(!kntmp))

		if (WARN_ON(!kntmp)) {

			dput(dentry);

			return ERR_PTR(-EINVAL);

		}

		dtmp = lookup_one_len_unlocked(kntmp->name, dentry,

					       strlen(kntmp->name));

		dput(dentry);

kernel/cgroup/cgroup.c

+6 −3
Original line number Diff line number Diff line
@@ -2033,7 +2033,7 @@ struct dentry *cgroup_do_mount(struct file_system_type *fs_type, int flags, 
			       struct cgroup_namespace *ns)

{

	struct dentry *dentry;

	bool new_sb;

	bool new_sb = false;



	dentry = kernfs_mount(fs_type, flags, root->kf_root, magic, &new_sb);
@@ -2043,6 +2043,7 @@ struct dentry *cgroup_do_mount(struct file_system_type *fs_type, int flags, 
	 */

	if (!IS_ERR(dentry) && ns != &init_cgroup_ns) {

		struct dentry *nsdentry;

		struct super_block *sb = dentry->d_sb;

		struct cgroup *cgrp;



		mutex_lock(&cgroup_mutex);
@@ -2053,12 +2054,14 @@ struct dentry *cgroup_do_mount(struct file_system_type *fs_type, int flags, 
		spin_unlock_irq(&css_set_lock);

		mutex_unlock(&cgroup_mutex);



		nsdentry = kernfs_node_dentry(cgrp->kn, dentry->d_sb);

		nsdentry = kernfs_node_dentry(cgrp->kn, sb);

		dput(dentry);

		if (IS_ERR(nsdentry))

			deactivate_locked_super(sb);

		dentry = nsdentry;

	}



	if (IS_ERR(dentry) || !new_sb)

	if (!new_sb)

		cgroup_put(&root->cgrp);



	return dentry;

CRA Git | Maintained and supported by SUSTech CRA and CCSE