Commit e605b365 authored by Tejun Heo's avatar Tejun Heo

cgroup: fix cgroup_subsys_state leak for seq_files

If a cgroup file implements either read_map() or read_seq_string(),
such file is served using seq_file by overriding file->f_op to
cgroup_seqfile_operations, which also overrides the release method to
single_release() from cgroup_file_release().

Because cgroup_file_open() didn't use to acquire any resources, this
used to be fine, but since f7d58818 ("cgroup: pin
cgroup_subsys_state when opening a cgroupfs file"), cgroup_file_open()
pins the css (cgroup_subsys_state) which is put by
cgroup_file_release().  The patch forgot to update the release path
for seq_files and each open/release cycle leaks a css reference.

Fix it by updating cgroup_file_release() to also handle seq_files and
using it for seq_file release path too.
Signed-off-by: default avatarTejun Heo <tj@kernel.org>
Cc: stable@vger.kernel.org # v3.12
parent 0fc0287c
...@@ -199,6 +199,7 @@ static void cgroup_destroy_css_killed(struct cgroup *cgrp); ...@@ -199,6 +199,7 @@ static void cgroup_destroy_css_killed(struct cgroup *cgrp);
static int cgroup_destroy_locked(struct cgroup *cgrp); static int cgroup_destroy_locked(struct cgroup *cgrp);
static int cgroup_addrm_files(struct cgroup *cgrp, struct cftype cfts[], static int cgroup_addrm_files(struct cgroup *cgrp, struct cftype cfts[],
bool is_add); bool is_add);
static int cgroup_file_release(struct inode *inode, struct file *file);
/** /**
* cgroup_css - obtain a cgroup's css for the specified subsystem * cgroup_css - obtain a cgroup's css for the specified subsystem
...@@ -2429,7 +2430,7 @@ static const struct file_operations cgroup_seqfile_operations = { ...@@ -2429,7 +2430,7 @@ static const struct file_operations cgroup_seqfile_operations = {
.read = seq_read, .read = seq_read,
.write = cgroup_file_write, .write = cgroup_file_write,
.llseek = seq_lseek, .llseek = seq_lseek,
.release = single_release, .release = cgroup_file_release,
}; };
static int cgroup_file_open(struct inode *inode, struct file *file) static int cgroup_file_open(struct inode *inode, struct file *file)
...@@ -2490,6 +2491,8 @@ static int cgroup_file_release(struct inode *inode, struct file *file) ...@@ -2490,6 +2491,8 @@ static int cgroup_file_release(struct inode *inode, struct file *file)
ret = cft->release(inode, file); ret = cft->release(inode, file);
if (css->ss) if (css->ss)
css_put(css); css_put(css);
if (file->f_op == &cgroup_seqfile_operations)
single_release(inode, file);
return ret; return ret;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment