[PATCH] perf: Fix refcount leak on perf_cgroup_ensure_storage error

[Jann Horn]

If perf_cgroup_ensure_storage() fails, perf_cgroup_connect() has already
acquired a reference on the cgroup_subsys_state.
Drop that reference before returning.

This probably doesn't matter in practice - it only makes a difference if
a kmalloc allocation fails, with allocation size depending on the cgroup
nesting depth.

Fixes: c2283c9368d4 ("perf/cgroup: Grow per perf_cpu_context heap storage")
Signed-off-by: Jann Horn <jannh@xxxxxxxxxx>
---
I've tested manually that forcing the failure path without this patch
causes the refcount to go up and stay up, while after applying the
patch, the refcount drops back to its original value.
---
 kernel/events/core.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index 33210aff3ee6..557c950eae06 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -1143,8 +1143,10 @@ static inline int perf_cgroup_connect(int fd, struct perf_event *event,
 		return PTR_ERR(css);
 
 	ret = perf_cgroup_ensure_storage(event, css);
-	if (ret)
+	if (ret) {
+		css_put(css);
 		return ret;
+	}
 
 	cgrp = container_of(css, struct perf_cgroup, css);
 	event->cgrp = cgrp;

---
base-commit: 08df884136f1c1197bab2a27814404fd329d9aac
change-id: 20260912-perf-cgroup-refleak-b9b7e5417683

Best regards,
--  
Jann Horn <jannh@xxxxxxxxxx>