Xiaochen Shen 7589992469 x86/resctrl: Add necessary kernfs_put() calls to prevent refcount leak ... On resource group creation via a mkdir an extra kernfs_node reference is obtained by kernfs_get() to ensure that the rdtgroup structure remains accessible for the rdtgroup_kn_unlock() calls where it is removed on deletion. Currently the extra kernfs_node reference count is only dropped by kernfs_put() in rdtgroup_kn_unlock() while the rdtgroup structure is removed in a few other locations that lack the matching reference drop. In call paths of rmdir and umount, when a control group is removed, kernfs_remove() is called to remove the whole kernfs nodes tree of the control group (including the kernfs nodes trees of all child monitoring groups), and then rdtgroup structure is freed by kfree(). The rdtgroup structures of all child monitoring groups under the control group are freed by kfree() in free_all_child_rdtgrp(). Before calling kfree() to free the rdtgroup structures, the kernfs node of the control group itself as well as the kernfs nodes of all child monitoring groups still take the extra references which will never be dropped to 0 and the kernfs nodes will never be freed. It leads to reference count leak and kernfs_node_cache memory leak. For example, reference count leak is observed in these two cases: (1) mount -t resctrl resctrl /sys/fs/resctrl mkdir /sys/fs/resctrl/c1 mkdir /sys/fs/resctrl/c1/mon_groups/m1 umount /sys/fs/resctrl (2) mkdir /sys/fs/resctrl/c1 mkdir /sys/fs/resctrl/c1/mon_groups/m1 rmdir /sys/fs/resctrl/c1 The same reference count leak issue also exists in the error exit paths of mkdir in mkdir_rdt_prepare() and rdtgroup_mkdir_ctrl_mon(). Fix this issue by following changes to make sure the extra kernfs_node reference on rdtgroup is dropped before freeing the rdtgroup structure. (1) Introduce rdtgroup removal helper rdtgroup_remove() to wrap up kernfs_put() and kfree(). (2) Call rdtgroup_remove() in rdtgroup removal path where the rdtgroup structure is about to be freed by kfree(). (3) Call rdtgroup_remove() or kernfs_put() as appropriate in the error exit paths of mkdir where an extra reference is taken by kernfs_get(). Fixes: f3cbeacaa0 ("x86/intel_rdt/cqm: Add rmdir support") Fixes: e02737d5b8 ("x86/intel_rdt: Add tasks files") Fixes: 60cf5e101f ("x86/intel_rdt: Add mkdir to resctrl file system") Reported-by: Willem de Bruijn <willemb@google.com> Signed-off-by: Xiaochen Shen <xiaochen.shen@intel.com> Signed-off-by: Borislav Petkov <bp@suse.de> Reviewed-by: Reinette Chatre <reinette.chatre@intel.com> Cc: stable@vger.kernel.org Link: https://lkml.kernel.org/r/1604085088-31707-1-git-send-email-xiaochen.shen@intel.com		2020-11-24 12:13:37 +01:00
..
core.c	* Misc cleanups to the resctrl code in preparation for the ARM side, by	2020-10-12 10:53:32 -07:00
ctrlmondata.c	x86/resctrl: Add struct rdt_cache::arch_has_{sparse, empty}_bitmaps	2020-08-19 10:41:40 +02:00
internal.h	x86/resctrl: Enable user to view thread or core throttling mode	2020-08-26 17:53:22 +02:00
Makefile	x86/resctrl: Avoid confusion over the new X86_RESCTRL config	2019-02-02 10:34:52 +01:00
monitor.c	x86/resctrl: Use container_of() in delayed_work handlers	2020-08-18 17:05:08 +02:00
pseudo_lock.c	mmap locking API: convert mmap_sem comments	2020-06-09 09:39:14 -07:00
pseudo_lock_event.h
rdtgroup.c	x86/resctrl: Add necessary kernfs_put() calls to prevent refcount leak	2020-11-24 12:13:37 +01:00