| From 4b6d65e42a81aaa235934a181c08c981d3dd76a9 Mon Sep 17 00:00:00 2001 |
| From: Tejun Heo <tj@kernel.org> |
| Date: Mon, 19 Nov 2012 08:13:35 -0800 |
| Subject: [PATCH] cgroup: remove incorrect dget/dput() pair in |
| cgroup_create_dir() |
| |
| commit 175431635ec09b1d1bba04979b006b99e8305a83 upstream. |
| |
| cgroup_create_dir() does weird dancing with dentry refcnt. On |
| success, it gets and then puts it achieving nothing. On failure, it |
| puts but there isn't no matching get anywhere leading to the following |
| oops if cgroup_create_file() fails for whatever reason. |
| |
| ------------[ cut here ]------------ |
| kernel BUG at /work/os/work/fs/dcache.c:552! |
| invalid opcode: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC |
| Modules linked in: |
| CPU 2 |
| Pid: 697, comm: mkdir Not tainted 3.7.0-rc4-work+ #3 Bochs Bochs |
| RIP: 0010:[<ffffffff811d9c0c>] [<ffffffff811d9c0c>] dput+0x1dc/0x1e0 |
| RSP: 0018:ffff88001a3ebef8 EFLAGS: 00010246 |
| RAX: 0000000000000000 RBX: ffff88000e5b1ef8 RCX: 0000000000000403 |
| RDX: 0000000000000303 RSI: 2000000000000000 RDI: ffff88000e5b1f58 |
| RBP: ffff88001a3ebf18 R08: ffffffff82c76960 R09: 0000000000000001 |
| R10: ffff880015022080 R11: ffd9bed70f48a041 R12: 00000000ffffffea |
| R13: 0000000000000001 R14: ffff88000e5b1f58 R15: 00007fff57656d60 |
| FS: 00007ff05fcb3800(0000) GS:ffff88001fd00000(0000) knlGS:0000000000000000 |
| CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 |
| CR2: 00000000004046f0 CR3: 000000001315f000 CR4: 00000000000006e0 |
| DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 |
| DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 |
| Process mkdir (pid: 697, threadinfo ffff88001a3ea000, task ffff880015022080) |
| Stack: |
| ffff88001a3ebf48 00000000ffffffea 0000000000000001 0000000000000000 |
| ffff88001a3ebf38 ffffffff811cc889 0000000000000001 ffff88000e5b1ef8 |
| ffff88001a3ebf68 ffffffff811d1fc9 ffff8800198d7f18 ffff880019106ef8 |
| Call Trace: |
| [<ffffffff811cc889>] done_path_create+0x19/0x50 |
| [<ffffffff811d1fc9>] sys_mkdirat+0x59/0x80 |
| [<ffffffff811d2009>] sys_mkdir+0x19/0x20 |
| [<ffffffff81be1e02>] system_call_fastpath+0x16/0x1b |
| Code: 00 48 8d 90 18 01 00 00 48 89 93 c0 00 00 00 4c 89 a0 18 01 00 00 48 8b 83 a0 00 00 00 83 80 28 01 00 00 01 e8 e6 6f a0 00 eb 92 <0f> 0b 66 90 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 49 89 fe 41 |
| RIP [<ffffffff811d9c0c>] dput+0x1dc/0x1e0 |
| RSP <ffff88001a3ebef8> |
| ---[ end trace 1277bcfd9561ddb0 ]--- |
| |
| Fix it by dropping the unnecessary dget/dput() pair. |
| |
| Signed-off-by: Tejun Heo <tj@kernel.org> |
| Acked-by: Li Zefan <lizefan@huawei.com> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| --- |
| kernel/cgroup.c | 2 -- |
| 1 file changed, 2 deletions(-) |
| |
| diff --git a/kernel/cgroup.c b/kernel/cgroup.c |
| index bf4f78f026e8..477bb7e17779 100644 |
| --- a/kernel/cgroup.c |
| +++ b/kernel/cgroup.c |
| @@ -2187,9 +2187,7 @@ static int cgroup_create_dir(struct cgroup *cgrp, struct dentry *dentry, |
| dentry->d_fsdata = cgrp; |
| inc_nlink(parent->d_inode); |
| rcu_assign_pointer(cgrp->dentry, dentry); |
| - dget(dentry); |
| } |
| - dput(dentry); |
| |
| return error; |
| } |
| -- |
| 1.8.5.2 |
| |