[PATCH] perf: Fix refcount leak on perf_cgroup_ensure_storage error

[PATCH] perf: Fix refcount leak on perf_cgroup_ensure_storage error

[Jann Horn]

If perf_cgroup_ensure_storage() fails, perf_cgroup_connect() has already
acquired a reference on the cgroup_subsys_state.
Drop that reference before returning.

This probably doesn't matter in practice - it only makes a difference if
a kmalloc allocation fails, with allocation size depending on the cgroup
nesting depth.

Fixes: c2283c9368d4 ("perf/cgroup: Grow per perf_cpu_context heap storage")
Signed-off-by: Jann Horn <jannh@google.com>
---
I've tested manually that forcing the failure path without this patch
causes the refcount to go up and stay up, while after applying the
patch, the refcount drops back to its original value.
---
 kernel/events/core.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index 33210aff3ee6..557c950eae06 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -1143,8 +1143,10 @@ static inline int perf_cgroup_connect(int fd, struct perf_event *event,
 		return PTR_ERR(css);
 
 	ret = perf_cgroup_ensure_storage(event, css);
-	if (ret)
+	if (ret) {
+		css_put(css);
 		return ret;
+	}
 
 	cgrp = container_of(css, struct perf_cgroup, css);
 	event->cgrp = cgrp;

---
base-commit: 08df884136f1c1197bab2a27814404fd329d9aac
change-id: 20260912-perf-cgroup-refleak-b9b7e5417683

Best regards,
--  
Jann Horn <jannh@google.com>

Re: [PATCH] perf: Fix refcount leak on perf_cgroup_ensure_storage error

[Ian Rogers]

On Mon, Sep 14, 2026 at 3:37 AM Jann Horn <jannh@google.com> wrote:
>
> If perf_cgroup_ensure_storage() fails, perf_cgroup_connect() has already
> acquired a reference on the cgroup_subsys_state.
> Drop that reference before returning.
>
> This probably doesn't matter in practice - it only makes a difference if
> a kmalloc allocation fails, with allocation size depending on the cgroup
> nesting depth.
>
> Fixes: c2283c9368d4 ("perf/cgroup: Grow per perf_cpu_context heap storage")
> Signed-off-by: Jann Horn <jannh@google.com>

I see that on the non-error path the css becomes a cgroup via
container_of that is handed to the event and css_put is in
__free_event/perf_detach_cgroup. Making the error path also css_put
makes sense.

Reviewed-by: Ian Rogers <irogers@google.com>

Thanks,
Ian

> ---
> I've tested manually that forcing the failure path without this patch
> causes the refcount to go up and stay up, while after applying the
> patch, the refcount drops back to its original value.
> ---
>  kernel/events/core.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/kernel/events/core.c b/kernel/events/core.c
> index 33210aff3ee6..557c950eae06 100644
> --- a/kernel/events/core.c
> +++ b/kernel/events/core.c
> @@ -1143,8 +1143,10 @@ static inline int perf_cgroup_connect(int fd, struct perf_event *event,
>                 return PTR_ERR(css);
>
>         ret = perf_cgroup_ensure_storage(event, css);
> -       if (ret)
> +       if (ret) {
> +               css_put(css);
>                 return ret;
> +       }
>
>         cgrp = container_of(css, struct perf_cgroup, css);
>         event->cgrp = cgrp;
>
> ---
> base-commit: 08df884136f1c1197bab2a27814404fd329d9aac
> change-id: 20260912-perf-cgroup-refleak-b9b7e5417683
>
> Best regards,
> --
> Jann Horn <jannh@google.com>
>