diff options
| author | Tejun Heo <tj@kernel.org> | 2013-11-27 18:16:21 -0500 |
|---|---|---|
| committer | Tejun Heo <tj@kernel.org> | 2013-11-27 18:16:21 -0500 |
| commit | e605b36575e896edd8161534550c9ea021b03bc0 (patch) | |
| tree | 3505166d31674b264cc00f7a5fa6836f6f7b35cf | |
| parent | 0fc0287c9ed1ffd3706f8b4d9b314aa102ef1245 (diff) | |
| download | linux-stable-e605b36575e896edd8161534550c9ea021b03bc0.tar.gz linux-stable-e605b36575e896edd8161534550c9ea021b03bc0.tar.bz2 linux-stable-e605b36575e896edd8161534550c9ea021b03bc0.zip | |
cgroup: fix cgroup_subsys_state leak for seq_files
If a cgroup file implements either read_map() or read_seq_string(),
such file is served using seq_file by overriding file->f_op to
cgroup_seqfile_operations, which also overrides the release method to
single_release() from cgroup_file_release().
Because cgroup_file_open() didn't use to acquire any resources, this
used to be fine, but since f7d58818ba42 ("cgroup: pin
cgroup_subsys_state when opening a cgroupfs file"), cgroup_file_open()
pins the css (cgroup_subsys_state) which is put by
cgroup_file_release(). The patch forgot to update the release path
for seq_files and each open/release cycle leaks a css reference.
Fix it by updating cgroup_file_release() to also handle seq_files and
using it for seq_file release path too.
Signed-off-by: Tejun Heo <tj@kernel.org>
Cc: stable@vger.kernel.org # v3.12
| -rw-r--r-- | kernel/cgroup.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/kernel/cgroup.c b/kernel/cgroup.c index a7b98ee35ef7..8b729c278b64 100644 --- a/kernel/cgroup.c +++ b/kernel/cgroup.c @@ -199,6 +199,7 @@ static void cgroup_destroy_css_killed(struct cgroup *cgrp); static int cgroup_destroy_locked(struct cgroup *cgrp); static int cgroup_addrm_files(struct cgroup *cgrp, struct cftype cfts[], bool is_add); +static int cgroup_file_release(struct inode *inode, struct file *file); /** * cgroup_css - obtain a cgroup's css for the specified subsystem @@ -2429,7 +2430,7 @@ static const struct file_operations cgroup_seqfile_operations = { .read = seq_read, .write = cgroup_file_write, .llseek = seq_lseek, - .release = single_release, + .release = cgroup_file_release, }; static int cgroup_file_open(struct inode *inode, struct file *file) @@ -2490,6 +2491,8 @@ static int cgroup_file_release(struct inode *inode, struct file *file) ret = cft->release(inode, file); if (css->ss) css_put(css); + if (file->f_op == &cgroup_seqfile_operations) + single_release(inode, file); return ret; } |