[PATCH 4.14 072/183] fix cgroup_do_mount() handling of failure exits

[Greg Kroah-Hartman]

4.14-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Al Viro <v...@zeniv.linux.org.uk>

commit 399504e21a10be16dd1408ba0147367d9d82a10c upstream.

same story as with last May fixes in sysfs (7b745a4e4051
"unfuck sysfs_mount()"); new_sb is left uninitialized
in case of early errors in kernfs_mount_ns() and papering
over it by treating any error from kernfs_mount_ns() as
equivalent to !new_ns ends up conflating the cases when
objects had never been transferred to a superblock with
ones when that has happened and resulting new superblock
had been dropped.  Easily fixed (same way as in sysfs
case).  Additionally, there's a superblock leak on
kernfs_node_dentry() failure *and* a dentry leak inside
kernfs_node_dentry() itself - the latter on probably
impossible errors, but the former not impossible to trigger
(as the matter of fact, injecting allocation failures
at that point *does* trigger it).

Cc: sta...@kernel.org
Signed-off-by: Al Viro <v...@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---
 fs/kernfs/mount.c      |    8 ++++++--
 kernel/cgroup/cgroup.c |    9 ++++++---
 2 files changed, 12 insertions(+), 5 deletions(-)

--- a/fs/kernfs/mount.c
+++ b/fs/kernfs/mount.c
@@ -196,8 +196,10 @@ struct dentry *kernfs_node_dentry(struct
                return dentry;
 
        knparent = find_next_ancestor(kn, NULL);
-       if (WARN_ON(!knparent))
+       if (WARN_ON(!knparent)) {
+               dput(dentry);
                return ERR_PTR(-EINVAL);
+       }
 
        do {
                struct dentry *dtmp;
@@ -206,8 +208,10 @@ struct dentry *kernfs_node_dentry(struct
                if (kn == knparent)
                        return dentry;
                kntmp = find_next_ancestor(kn, knparent);
-               if (WARN_ON(!kntmp))
+               if (WARN_ON(!kntmp)) {
+                       dput(dentry);
                        return ERR_PTR(-EINVAL);
+               }
                dtmp = lookup_one_len_unlocked(kntmp->name, dentry,
                                               strlen(kntmp->name));
                dput(dentry);
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -1942,7 +1942,7 @@ struct dentry *cgroup_do_mount(struct fi
                               struct cgroup_namespace *ns)
 {
        struct dentry *dentry;
-       bool new_sb;
+       bool new_sb = false;
 
        dentry = kernfs_mount(fs_type, flags, root->kf_root, magic, &new_sb);
 
@@ -1952,6 +1952,7 @@ struct dentry *cgroup_do_mount(struct fi
         */
        if (!IS_ERR(dentry) && ns != &init_cgroup_ns) {
                struct dentry *nsdentry;
+               struct super_block *sb = dentry->d_sb;
                struct cgroup *cgrp;
 
                mutex_lock(&cgroup_mutex);
@@ -1962,12 +1963,14 @@ struct dentry *cgroup_do_mount(struct fi
                spin_unlock_irq(&css_set_lock);
                mutex_unlock(&cgroup_mutex);
 
-               nsdentry = kernfs_node_dentry(cgrp->kn, dentry->d_sb);
+               nsdentry = kernfs_node_dentry(cgrp->kn, sb);
                dput(dentry);
+               if (IS_ERR(nsdentry))
+                       deactivate_locked_super(sb);
                dentry = nsdentry;
        }
 
-       if (IS_ERR(dentry) || !new_sb)
+       if (!new_sb)
                cgroup_put(&root->cgrp);
 
        return dentry;