diff options
| author | Andrew Morton <akpm@linux-foundation.org> | 2022-12-09 19:31:11 -0800 |
|---|---|---|
| committer | Andrew Morton <akpm@linux-foundation.org> | 2022-12-09 19:31:11 -0800 |
| commit | 3b91010500eba3601e906b0e92cf84fab4d895d1 (patch) | |
| tree | 6724b9c611dc32115bb2e0d7a6f45d007830b2b8 /mm/memcontrol.c | |
| parent | e0ff428042335c7b62785b3cf911c427a618bc86 (diff) | |
| parent | 4a7ba45b1a435e7097ca0f79a847d0949d0eb088 (diff) | |
| download | linux-3b91010500eba3601e906b0e92cf84fab4d895d1.tar.bz2 | |
Merge branch 'mm-hotfixes-stable' into mm-stable
Diffstat (limited to 'mm/memcontrol.c')
| -rw-r--r-- | mm/memcontrol.c | 15 |
1 files changed, 13 insertions, 2 deletions
diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 23750cec0036..2c7a91689fef 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -4836,6 +4836,7 @@ static ssize_t memcg_write_event_control(struct kernfs_open_file *of, unsigned int efd, cfd; struct fd efile; struct fd cfile; + struct dentry *cdentry; const char *name; char *endp; int ret; @@ -4890,6 +4891,16 @@ static ssize_t memcg_write_event_control(struct kernfs_open_file *of, goto out_put_cfile; /* + * The control file must be a regular cgroup1 file. As a regular cgroup + * file can't be renamed, it's safe to access its name afterwards. + */ + cdentry = cfile.file->f_path.dentry; + if (cdentry->d_sb->s_type != &cgroup_fs_type || !d_is_reg(cdentry)) { + ret = -EINVAL; + goto out_put_cfile; + } + + /* * Determine the event callbacks and set them in @event. This used * to be done via struct cftype but cgroup core no longer knows * about these events. The following is crude but the whole thing @@ -4897,7 +4908,7 @@ static ssize_t memcg_write_event_control(struct kernfs_open_file *of, * * DO NOT ADD NEW FILES. */ - name = cfile.file->f_path.dentry->d_name.name; + name = cdentry->d_name.name; if (!strcmp(name, "memory.usage_in_bytes")) { event->register_event = mem_cgroup_usage_register_event; @@ -4921,7 +4932,7 @@ static ssize_t memcg_write_event_control(struct kernfs_open_file *of, * automatically removed on cgroup destruction but the removal is * asynchronous, so take an extra ref on @css. */ - cfile_css = css_tryget_online_from_dir(cfile.file->f_path.dentry->d_parent, + cfile_css = css_tryget_online_from_dir(cdentry->d_parent, &memory_cgrp_subsys); ret = -EINVAL; if (IS_ERR(cfile_css)) |