[lkml]   [2013]   [Dec]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Patch in this message
Subject[PATCH 3.12 156/212] cgroup: fix cgroup_subsys_state leak for seq_files
3.12-stable review patch.  If anyone has any objections, please let me know.


From: Tejun Heo <>

commit e605b36575e896edd8161534550c9ea021b03bc0 upstream.

If a cgroup file implements either read_map() or read_seq_string(),
such file is served using seq_file by overriding file->f_op to
cgroup_seqfile_operations, which also overrides the release method to
single_release() from cgroup_file_release().

Because cgroup_file_open() didn't use to acquire any resources, this
used to be fine, but since f7d58818ba42 ("cgroup: pin
cgroup_subsys_state when opening a cgroupfs file"), cgroup_file_open()
pins the css (cgroup_subsys_state) which is put by
cgroup_file_release(). The patch forgot to update the release path
for seq_files and each open/release cycle leaks a css reference.

Fix it by updating cgroup_file_release() to also handle seq_files and
using it for seq_file release path too.

Signed-off-by: Tejun Heo <>
Signed-off-by: Greg Kroah-Hartman <>

kernel/cgroup.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)

--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -231,6 +231,7 @@ static void cgroup_destroy_css_killed(st
static int cgroup_destroy_locked(struct cgroup *cgrp);
static int cgroup_addrm_files(struct cgroup *cgrp, struct cftype cfts[],
bool is_add);
+static int cgroup_file_release(struct inode *inode, struct file *file);

* cgroup_css - obtain a cgroup's css for the specified subsystem
@@ -2471,7 +2472,7 @@ static const struct file_operations cgro
.read = seq_read,
.write = cgroup_file_write,
.llseek = seq_lseek,
- .release = single_release,
+ .release = cgroup_file_release,

static int cgroup_file_open(struct inode *inode, struct file *file)
@@ -2532,6 +2533,8 @@ static int cgroup_file_release(struct in
ret = cft->release(inode, file);
if (css->ss)
+ if (file->f_op == &cgroup_seqfile_operations)
+ single_release(inode, file);
return ret;

 \ /
  Last update: 2013-12-03 08:01    [W:0.566 / U:0.064 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site