Commit 446b1c7a authored by John Sperbeck's avatar John Sperbeck Committed by wufan19
Browse files

cgroup: always put cset in cgroup_css_set_put_fork 

mainline inclusion
from mainline-v6.4-rc6
commit 2bd11033
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7E0F3
CVE: NA

Reference:https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2bd110339288c18823dcace602b63b0d8627e520



-------------------------------------------------

A successful call to cgroup_css_set_fork() will always have taken
a ref on kargs->cset (regardless of CLONE_INTO_CGROUP), so always
do a corresponding put in cgroup_css_set_put_fork().

Without this, a cset and its contained css structures will be
leaked for some fork failures.  The following script reproduces
the leak for a fork failure due to exceeding pids.max in the
pids controller.  A similar thing can happen if we jump to the
bad_fork_cancel_cgroup label in copy_process().

[ -z "$1" ] && echo "Usage $0 pids-root" && exit 1
PID_ROOT=$1
CGROUP=$PID_ROOT/foo

[ -e $CGROUP ] && rmdir -f $CGROUP
mkdir $CGROUP
echo 5 > $CGROUP/pids.max
echo $$ > $CGROUP/cgroup.procs

fork_bomb()
{
	set -e
	for i in $(seq 10); do
		/bin/sleep 3600 &
	done
}

(fork_bomb) &
wait
echo $$ > $PID_ROOT/cgroup.procs
kill $(cat $CGROUP/cgroup.procs)
rmdir $CGROUP

Fixes: ef2c41cf ("clone3: allow spawning processes into cgroups")
Cc: stable@vger.kernel.org # v5.7+
Signed-off-by: default avatarJohn Sperbeck <jsperbeck@google.com>
Signed-off-by: default avatarTejun Heo <tj@kernel.org>
Signed-off-by: default avatarwufan19 <wufan19@meituan.com>
parent 13d304e4

kernel/cgroup/cgroup.c

+8 −9
Original line number Diff line number Diff line
@@ -6334,19 +6334,18 @@ static int cgroup_css_set_fork(struct kernel_clone_args *kargs) 
static void cgroup_css_set_put_fork(struct kernel_clone_args *kargs)

	__releases(&cgroup_threadgroup_rwsem) __releases(&cgroup_mutex)

{

	cgroup_threadgroup_change_end(current);



	if (kargs->flags & CLONE_INTO_CGROUP) {

	struct cgroup *cgrp = kargs->cgrp;

	struct css_set *cset = kargs->cset;



		mutex_unlock(&cgroup_mutex);

	cgroup_threadgroup_change_end(current);



	if (cset) {

		put_css_set(cset);

		kargs->cset = NULL;

	}



	if (kargs->flags & CLONE_INTO_CGROUP) {

		mutex_unlock(&cgroup_mutex);

		if (cgrp) {

			cgroup_put(cgrp);

			kargs->cgrp = NULL;