1 From 399504e21a10be16dd1408ba0147367d9d82a10c Mon Sep 17 00:00:00 2001
2 From: Al Viro <viro@zeniv.linux.org.uk>
3 Date: Sun, 6 Jan 2019 11:41:29 -0500
4 Subject: fix cgroup_do_mount() handling of failure exits
6 From: Al Viro <viro@zeniv.linux.org.uk>
8 commit 399504e21a10be16dd1408ba0147367d9d82a10c upstream.
10 same story as with last May fixes in sysfs (7b745a4e4051
11 "unfuck sysfs_mount()"); new_sb is left uninitialized
12 in case of early errors in kernfs_mount_ns() and papering
13 over it by treating any error from kernfs_mount_ns() as
14 equivalent to !new_ns ends up conflating the cases when
15 objects had never been transferred to a superblock with
16 ones when that has happened and resulting new superblock
17 had been dropped. Easily fixed (same way as in sysfs
18 case). Additionally, there's a superblock leak on
19 kernfs_node_dentry() failure *and* a dentry leak inside
20 kernfs_node_dentry() itself - the latter on probably
21 impossible errors, but the former not impossible to trigger
22 (as the matter of fact, injecting allocation failures
23 at that point *does* trigger it).
26 Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
27 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
30 fs/kernfs/mount.c | 8 ++++++--
31 kernel/cgroup/cgroup.c | 9 ++++++---
32 2 files changed, 12 insertions(+), 5 deletions(-)
34 --- a/fs/kernfs/mount.c
35 +++ b/fs/kernfs/mount.c
36 @@ -196,8 +196,10 @@ struct dentry *kernfs_node_dentry(struct
39 knparent = find_next_ancestor(kn, NULL);
40 - if (WARN_ON(!knparent))
41 + if (WARN_ON(!knparent)) {
43 return ERR_PTR(-EINVAL);
48 @@ -206,8 +208,10 @@ struct dentry *kernfs_node_dentry(struct
51 kntmp = find_next_ancestor(kn, knparent);
52 - if (WARN_ON(!kntmp))
53 + if (WARN_ON(!kntmp)) {
55 return ERR_PTR(-EINVAL);
57 dtmp = lookup_one_len_unlocked(kntmp->name, dentry,
60 --- a/kernel/cgroup/cgroup.c
61 +++ b/kernel/cgroup/cgroup.c
62 @@ -2033,7 +2033,7 @@ struct dentry *cgroup_do_mount(struct fi
63 struct cgroup_namespace *ns)
65 struct dentry *dentry;
67 + bool new_sb = false;
69 dentry = kernfs_mount(fs_type, flags, root->kf_root, magic, &new_sb);
71 @@ -2043,6 +2043,7 @@ struct dentry *cgroup_do_mount(struct fi
73 if (!IS_ERR(dentry) && ns != &init_cgroup_ns) {
74 struct dentry *nsdentry;
75 + struct super_block *sb = dentry->d_sb;
78 mutex_lock(&cgroup_mutex);
79 @@ -2053,12 +2054,14 @@ struct dentry *cgroup_do_mount(struct fi
80 spin_unlock_irq(&css_set_lock);
81 mutex_unlock(&cgroup_mutex);
83 - nsdentry = kernfs_node_dentry(cgrp->kn, dentry->d_sb);
84 + nsdentry = kernfs_node_dentry(cgrp->kn, sb);
86 + if (IS_ERR(nsdentry))
87 + deactivate_locked_super(sb);
91 - if (IS_ERR(dentry) || !new_sb)
93 cgroup_put(&root->cgrp);