From patchwork Sun May 21 19:29:53 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: John Sperbeck X-Patchwork-Id: 96901 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:b0ea:0:b0:3b6:4342:cba0 with SMTP id b10csp1024238vqo; Sun, 21 May 2023 12:33:39 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ422yq1mdvZIZM5azj9IALIe+bhKwVXK3+oEkNg5Y4NmoDw461vmkmrlR/aZDqEKfrALL0v X-Received: by 2002:a17:90a:a415:b0:253:3e9d:f920 with SMTP id y21-20020a17090aa41500b002533e9df920mr8227722pjp.3.1684697618689; Sun, 21 May 2023 12:33:38 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1684697618; cv=none; d=google.com; s=arc-20160816; b=juHfpZZcRSFlncxf4z1+uoNkvWO+k6Q/m9p86t2fyNJWe4BTyOxFG+KZS20tidzn3S njeZMcpOIf6QPOIR/bvTRbtDx/dDyWGEN6s+sl8tDqdLv+JFBqaFHTU2a5O0DUEg6PWV db6duzIVgFTX8NpYvX9IbJWF5Nr1ppfr9M9Mbkh32hMFcwIrCjBiHNzATVkbdxrkFtRN BpvroO5LK8Mg6WU1Nz/XZ0/+TnYYx7VENJ3Yv9D51wvw0Pl2wy6HVa2ne5oJMJJtVL9n paKLS2dF3gkmr8IeU75O6l+Y7VJmsZP32dUQ8gMxJupF82YH2c6NnlrC4DsAPxzjbA7X v7lQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:cc:to:from:subject:message-id:mime-version:date :dkim-signature; bh=QsimBcbFkkOqpywwSH5EJmOyk1K46aweYARqzOVnpbQ=; b=bu9FnVJ+q0W7YrFI/CNTtJ5Vg0Cw9zzhDA4eRZ5Xl8fqS2EbLM+9J1hyM2RYmL6zCH drq3BcAPYplKAnaBxnXObdWlc8ejZ+dbmguxtdhlzqy0rZKaH/lNWSG2qxtMACZx+O5r zF16NNgSdy4+0HUkLz7gFIhgBw7VE422L+xpMn/LG/uJMAbayCTGS3LOPNwfSCcm3e6E 9YdntmY+dqF1P0JFFKwaq+KTl2ZAAh9DCA3TENl5XiGbIndJ65tWwHIK7p+gwjGW6rOB Q+/IBjm39PirzEYvauIWg4JxD0VpvZ+5DeXOUENX0Bu7WiudAfJZA/rFmbRI67kwwAt9 vQ3Q== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@google.com header.s=20221208 header.b=AwAik3WB; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id q62-20020a17090a4fc400b0023d23393318si1874075pjh.55.2023.05.21.12.33.26; Sun, 21 May 2023 12:33:38 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@google.com header.s=20221208 header.b=AwAik3WB; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229837AbjEUTaY (ORCPT + 99 others); Sun, 21 May 2023 15:30:24 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38142 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229563AbjEUTaX (ORCPT ); Sun, 21 May 2023 15:30:23 -0400 Received: from mail-pj1-x104a.google.com (mail-pj1-x104a.google.com [IPv6:2607:f8b0:4864:20::104a]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EB4FDDD for ; Sun, 21 May 2023 12:30:18 -0700 (PDT) Received: by mail-pj1-x104a.google.com with SMTP id 98e67ed59e1d1-2533b1e6e66so2894169a91.3 for ; Sun, 21 May 2023 12:30:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20221208; t=1684697418; x=1687289418; h=cc:to:from:subject:message-id:mime-version:date:from:to:cc:subject :date:message-id:reply-to; bh=QsimBcbFkkOqpywwSH5EJmOyk1K46aweYARqzOVnpbQ=; b=AwAik3WBbsct7NHTK6mPHFMdHYq0nx82//vVz1V6opRw5i8IPg0Ue9Coqr0iV4/bk+ SD6HHE9uIf5r3eg6/MKyA7eUk8I3MrANEz+hkV7gQhVeURby/SVKQW7nV6gOc+y9lHLJ RscGr1/QqfmQMCRw7KydEfjk4FTpyhkfgP/XVgY0tXk+VgTH4yy7+98lBP5r3iFKoCty YOtb/qJ71FZIuoLQEP6DhJRGVOiVLDob2y2gMupeXKSi0qwe3K1IW/NHW9plCPo/jRfI 4J5Qyf6tlrDYkWoIKf+67HIDR+H14iGWbAx4tRshmD8zE50IlDQDS3OttxBrWj3+YGQL V50w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1684697418; x=1687289418; h=cc:to:from:subject:message-id:mime-version:date:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=QsimBcbFkkOqpywwSH5EJmOyk1K46aweYARqzOVnpbQ=; b=gNZRGjbN6TXVIiyIi4gEr220yvhOlUIQA72Tu6RzcVAYy/uJjq+cU7mGAqhwv/Coe7 AycLhWRtmUH7S5tzl4OjeXvRXOJjVpMniB8E11X/Cgcc0cEIbCGvOP2SGdkyzNqmhQKm IW+Rd0Eoghnb/rInR5sy+W8/4driEW02TkxoQppZZr7OdKADc6eTRZUGQfXx6mfloNmI SgtFL6xWAF4zWsjiOjd358SyI/Hk7SviHnXbU3fA0vvl8Se+qm0v7gCQftC4z99ZfDwH MgqoF/rsIXt80WK3qvCMmUIRH2wYbWQ1RlGchzyXU8Ov+Rn6L8ov4nUEbneOu/qhIPtx v4EA== X-Gm-Message-State: AC+VfDyjY1Na2uMbRpe+iw3pjeeZsQ4othHvIkl4mhfXAB16W+I/2K1S cyWSehu65MA4nMjUYWH9YDWBKcd7WUDIDyc= X-Received: from jsperbeck8.c.googlers.com ([fda3:e722:ac3:cc00:7f:e700:c0a8:301f]) (user=jsperbeck job=sendgmr) by 2002:a17:90a:b292:b0:255:4b79:1efe with SMTP id c18-20020a17090ab29200b002554b791efemr728122pjr.7.1684697418404; Sun, 21 May 2023 12:30:18 -0700 (PDT) Date: Sun, 21 May 2023 19:29:53 +0000 Mime-Version: 1.0 X-Mailer: git-send-email 2.40.1.698.g37aff9b760-goog Message-ID: <20230521192953.229715-1-jsperbeck@google.com> Subject: [PATCH] cgroup: always put cset in cgroup_css_set_put_fork From: John Sperbeck To: Tejun Heo , Zefan Li , Johannes Weiner , Christian Brauner Cc: cgroups@vger.kernel.org, linux-kernel@vger.kernel.org, John Sperbeck X-Spam-Status: No, score=-9.6 required=5.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE, SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE,USER_IN_DEF_DKIM_WL autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1766533490029997142?= X-GMAIL-MSGID: =?utf-8?q?1766533490029997142?= A successful call to cgroup_css_set_fork() will always have taken a ref on kargs->cset (regardless of CLONE_INTO_CGROUP), so always do a corresponding put in cgroup_css_set_put_fork(). Without this, a cset and its contained css structures will be leaked for some fork failures. The following script reproduces the leak for a fork failure due to exceeding pids.max in the pids controller. A similar thing can happen if we jump to the bad_fork_cancel_cgroup label in copy_process(). [ -z "$1" ] && echo "Usage $0 pids-root" && exit 1 PID_ROOT=$1 CGROUP=$PID_ROOT/foo [ -e $CGROUP ] && rmdir -f $CGROUP mkdir $CGROUP echo 5 > $CGROUP/pids.max echo $$ > $CGROUP/cgroup.procs fork_bomb() { set -e for i in $(seq 10); do /bin/sleep 3600 & done } (fork_bomb) & wait echo $$ > $PID_ROOT/cgroup.procs kill $(cat $CGROUP/cgroup.procs) rmdir $CGROUP Fixes: ef2c41cf38a7 ("clone3: allow spawning processes into cgroups") Signed-off-by: John Sperbeck Reviewed-by: Christian Brauner --- kernel/cgroup/cgroup.c | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c index 625d7483951c..245cf62ce85a 100644 --- a/kernel/cgroup/cgroup.c +++ b/kernel/cgroup/cgroup.c @@ -6486,19 +6486,18 @@ static int cgroup_css_set_fork(struct kernel_clone_args *kargs) static void cgroup_css_set_put_fork(struct kernel_clone_args *kargs) __releases(&cgroup_threadgroup_rwsem) __releases(&cgroup_mutex) { + struct cgroup *cgrp = kargs->cgrp; + struct css_set *cset = kargs->cset; + cgroup_threadgroup_change_end(current); - if (kargs->flags & CLONE_INTO_CGROUP) { - struct cgroup *cgrp = kargs->cgrp; - struct css_set *cset = kargs->cset; + if (cset) { + put_css_set(cset); + kargs->cset = NULL; + } + if (kargs->flags & CLONE_INTO_CGROUP) { cgroup_unlock(); - - if (cset) { - put_css_set(cset); - kargs->cset = NULL; - } - if (cgrp) { cgroup_put(cgrp); kargs->cgrp = NULL;