| Message ID | 20200309224017.1063297-1-andriin@fb.com |
|---|---|
| State | Accepted |
| Delegated to: | BPF Maintainers |
| Headers | show |
| Series | [bpf] bpf: fix cgroup ref leak in cgroup_bpf_inherit on out-of-memory | expand |
On Mon, Mar 09, 2020 at 03:40:17PM -0700, Andrii Nakryiko wrote: > There is no compensating cgroup_bpf_put() for each ancestor cgroup in > cgroup_bpf_inherit(). If compute_effective_progs returns error, those cgroups > won't be freed ever. Fix it by putting them in cleanup code path. > > Fixes: e10360f815ca ("bpf: cgroup: prevent out-of-order release of cgroup bpf") > Signed-off-by: Andrii Nakryiko <andriin@fb.com> Acked-by: Roman Gushchin <guro@fb.com> Thanks, Andrii!
On Mon, Mar 9, 2020 at 3:41 PM Andrii Nakryiko <andriin@fb.com> wrote: > > There is no compensating cgroup_bpf_put() for each ancestor cgroup in > cgroup_bpf_inherit(). If compute_effective_progs returns error, those cgroups > won't be freed ever. Fix it by putting them in cleanup code path. > > Fixes: e10360f815ca ("bpf: cgroup: prevent out-of-order release of cgroup bpf") > Signed-off-by: Andrii Nakryiko <andriin@fb.com> Applied. Thanks
diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c index 9a500fadbef5..5220a67392fc 100644 --- a/kernel/bpf/cgroup.c +++ b/kernel/bpf/cgroup.c @@ -227,6 +227,9 @@ int cgroup_bpf_inherit(struct cgroup *cgrp) for (i = 0; i < NR; i++) bpf_prog_array_free(arrays[i]); + for (p = cgroup_parent(cgrp); p; p = cgroup_parent(p)) + cgroup_bpf_put(p); + percpu_ref_exit(&cgrp->bpf.refcnt); return -ENOMEM;
There is no compensating cgroup_bpf_put() for each ancestor cgroup in cgroup_bpf_inherit(). If compute_effective_progs returns error, those cgroups won't be freed ever. Fix it by putting them in cleanup code path. Fixes: e10360f815ca ("bpf: cgroup: prevent out-of-order release of cgroup bpf") Signed-off-by: Andrii Nakryiko <andriin@fb.com> --- kernel/bpf/cgroup.c | 3 +++ 1 file changed, 3 insertions(+)