cgroup: fix cgroup_subsys_state leak for seq_files (e605b365) · Commits · 戴 / test

If a cgroup file implements either read_map() or read_seq_string(), such file is served using seq_file by overriding file->f_op to cgroup_seqfile_operations, which also overrides the release method to single_release() from cgroup_file_release(). Because cgroup_file_open() didn't use to acquire any resources, this used to be fine, but since ("cgroup: pin cgroup_subsys_state when opening a cgroupfs file"), cgroup_file_open() pins the css (cgroup_subsys_state) which is put by cgroup_file_release(). The patch forgot to update the release path for seq_files and each open/release cycle leaks a css reference. Fix it by updating cgroup_file_release() to also handle seq_files and using it for seq_file release path too. Signed-off-by:

Tejun Heo <tj@kernel.org> Cc: stable@vger.kernel.org # v3.12

kernel/cgroup.c

+4 −1

Original line number	Diff line number	Diff line
		@@ -199,6 +199,7 @@ static void cgroup_destroy_css_killed(struct cgroup *cgrp);
		static int cgroup_destroy_locked(struct cgroup *cgrp);
		static int cgroup_addrm_files(struct cgroup *cgrp, struct cftype cfts[],
		bool is_add);
		static int cgroup_file_release(struct inode inode, struct file file);

		/**
		* cgroup_css - obtain a cgroup's css for the specified subsystem
		@@ -2429,7 +2430,7 @@ static const struct file_operations cgroup_seqfile_operations = {
		.read = seq_read,
		.write = cgroup_file_write,
		.llseek = seq_lseek,
		.release = single_release,
		.release = cgroup_file_release,
		};

		static int cgroup_file_open(struct inode inode, struct file file)
		@@ -2490,6 +2491,8 @@ static int cgroup_file_release(struct inode inode, struct file file)
		ret = cft->release(inode, file);
		if (css->ss)
		css_put(css);
		if (file->f_op == &cgroup_seqfile_operations)
		single_release(inode, file);
		return ret;
		}

Admin message