summaryrefslogtreecommitdiff
path: root/mm/memcontrol.c
diff options
context:
space:
mode:
authorAndrew Morton <akpm@linux-foundation.org>2022-12-09 19:31:11 -0800
committerAndrew Morton <akpm@linux-foundation.org>2022-12-09 19:31:11 -0800
commit3b91010500eba3601e906b0e92cf84fab4d895d1 (patch)
tree6724b9c611dc32115bb2e0d7a6f45d007830b2b8 /mm/memcontrol.c
parente0ff428042335c7b62785b3cf911c427a618bc86 (diff)
parent4a7ba45b1a435e7097ca0f79a847d0949d0eb088 (diff)
Merge branch 'mm-hotfixes-stable' into mm-stable
Diffstat (limited to 'mm/memcontrol.c')
-rw-r--r--mm/memcontrol.c15
1 files changed, 13 insertions, 2 deletions
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 23750cec0036..2c7a91689fef 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -4836,6 +4836,7 @@ static ssize_t memcg_write_event_control(struct kernfs_open_file *of,
unsigned int efd, cfd;
struct fd efile;
struct fd cfile;
+ struct dentry *cdentry;
const char *name;
char *endp;
int ret;
@@ -4890,6 +4891,16 @@ static ssize_t memcg_write_event_control(struct kernfs_open_file *of,
goto out_put_cfile;
/*
+ * The control file must be a regular cgroup1 file. As a regular cgroup
+ * file can't be renamed, it's safe to access its name afterwards.
+ */
+ cdentry = cfile.file->f_path.dentry;
+ if (cdentry->d_sb->s_type != &cgroup_fs_type || !d_is_reg(cdentry)) {
+ ret = -EINVAL;
+ goto out_put_cfile;
+ }
+
+ /*
* Determine the event callbacks and set them in @event. This used
* to be done via struct cftype but cgroup core no longer knows
* about these events. The following is crude but the whole thing
@@ -4897,7 +4908,7 @@ static ssize_t memcg_write_event_control(struct kernfs_open_file *of,
*
* DO NOT ADD NEW FILES.
*/
- name = cfile.file->f_path.dentry->d_name.name;
+ name = cdentry->d_name.name;
if (!strcmp(name, "memory.usage_in_bytes")) {
event->register_event = mem_cgroup_usage_register_event;
@@ -4921,7 +4932,7 @@ static ssize_t memcg_write_event_control(struct kernfs_open_file *of,
* automatically removed on cgroup destruction but the removal is
* asynchronous, so take an extra ref on @css.
*/
- cfile_css = css_tryget_online_from_dir(cfile.file->f_path.dentry->d_parent,
+ cfile_css = css_tryget_online_from_dir(cdentry->d_parent,
&memory_cgrp_subsys);
ret = -EINVAL;
if (IS_ERR(cfile_css))