diff options
| author | Andrew Morton <akpm@linux-foundation.org> | 2022-12-10 04:31:11 +0100 |
|---|---|---|
| committer | Andrew Morton <akpm@linux-foundation.org> | 2022-12-10 04:31:11 +0100 |
| commit | 3b91010500eba3601e906b0e92cf84fab4d895d1 (patch) | |
| tree | 6724b9c611dc32115bb2e0d7a6f45d007830b2b8 /mm/memcontrol.c | |
| parent | mm/memory-failure.c: cleanup in unpoison_memory (diff) | |
| parent | memcg: fix possible use-after-free in memcg_write_event_control() (diff) | |
| download | linux-3b91010500eba3601e906b0e92cf84fab4d895d1.tar.xz linux-3b91010500eba3601e906b0e92cf84fab4d895d1.zip | |
Merge branch 'mm-hotfixes-stable' into mm-stable
Diffstat (limited to 'mm/memcontrol.c')
| -rw-r--r-- | mm/memcontrol.c | 15 |
1 files changed, 13 insertions, 2 deletions
diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 23750cec0036..2c7a91689fef 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -4836,6 +4836,7 @@ static ssize_t memcg_write_event_control(struct kernfs_open_file *of, unsigned int efd, cfd; struct fd efile; struct fd cfile; + struct dentry *cdentry; const char *name; char *endp; int ret; @@ -4890,6 +4891,16 @@ static ssize_t memcg_write_event_control(struct kernfs_open_file *of, goto out_put_cfile; /* + * The control file must be a regular cgroup1 file. As a regular cgroup + * file can't be renamed, it's safe to access its name afterwards. + */ + cdentry = cfile.file->f_path.dentry; + if (cdentry->d_sb->s_type != &cgroup_fs_type || !d_is_reg(cdentry)) { + ret = -EINVAL; + goto out_put_cfile; + } + + /* * Determine the event callbacks and set them in @event. This used * to be done via struct cftype but cgroup core no longer knows * about these events. The following is crude but the whole thing @@ -4897,7 +4908,7 @@ static ssize_t memcg_write_event_control(struct kernfs_open_file *of, * * DO NOT ADD NEW FILES. */ - name = cfile.file->f_path.dentry->d_name.name; + name = cdentry->d_name.name; if (!strcmp(name, "memory.usage_in_bytes")) { event->register_event = mem_cgroup_usage_register_event; @@ -4921,7 +4932,7 @@ static ssize_t memcg_write_event_control(struct kernfs_open_file *of, * automatically removed on cgroup destruction but the removal is * asynchronous, so take an extra ref on @css. */ - cfile_css = css_tryget_online_from_dir(cfile.file->f_path.dentry->d_parent, + cfile_css = css_tryget_online_from_dir(cdentry->d_parent, &memory_cgrp_subsys); ret = -EINVAL; if (IS_ERR(cfile_css)) |