diff options
| author | Li Zefan <lizf@cn.fujitsu.com> | 2010-02-02 13:44:10 -0800 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2010-02-02 18:11:22 -0800 |
| commit | 4528fd0595847c2078b59f24800e751c2d6b7e41 (patch) | |
| tree | 0be4aca79bc9b6709d4762f43ae53e2589931a85 /kernel | |
| parent | ef2b9b054580ef835078d8aa411bd06542cd5c1c (diff) | |
| download | kernel_samsung_tuna-4528fd0595847c2078b59f24800e751c2d6b7e41.zip kernel_samsung_tuna-4528fd0595847c2078b59f24800e751c2d6b7e41.tar.gz kernel_samsung_tuna-4528fd0595847c2078b59f24800e751c2d6b7e41.tar.bz2 | |
cgroups: fix to return errno in a failure path
In cgroup_create(), if alloc_css_id() returns failure, the errno is not
propagated to userspace, so mkdir will fail silently.
To trigger this bug, we mount blkio (or memory subsystem), and create more
then 65534 cgroups. (The number of cgroups is limited to 65535 if a
subsystem has use_id == 1)
# mount -t cgroup -o blkio xxx /mnt
# for ((i = 0; i < 65534; i++)); do mkdir /mnt/$i; done
# mkdir /mnt/65534
(should return ENOSPC)
#
Signed-off-by: Li Zefan <lizf@cn.fujitsu.com>
Acked-by: Serge Hallyn <serue@us.ibm.com>
Acked-by: Paul Menage <menage@google.com>
Acked-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'kernel')
| -rw-r--r-- | kernel/cgroup.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/kernel/cgroup.c b/kernel/cgroup.c index 1fbcc74..aa3bee5 100644 --- a/kernel/cgroup.c +++ b/kernel/cgroup.c @@ -2936,14 +2936,17 @@ static long cgroup_create(struct cgroup *parent, struct dentry *dentry, for_each_subsys(root, ss) { struct cgroup_subsys_state *css = ss->create(ss, cgrp); + if (IS_ERR(css)) { err = PTR_ERR(css); goto err_destroy; } init_cgroup_css(css, ss, cgrp); - if (ss->use_id) - if (alloc_css_id(ss, parent, cgrp)) + if (ss->use_id) { + err = alloc_css_id(ss, parent, cgrp); + if (err) goto err_destroy; + } /* At error, ->destroy() callback has to free assigned ID. */ } |