Re: [PATCH] perf: Fix refcount leak on perf_cgroup_ensure_storage error

[Ian Rogers]

On Mon, Sep 14, 2026 at 3:37 AM Jann Horn <jannh@xxxxxxxxxx> wrote:
>
> If perf_cgroup_ensure_storage() fails, perf_cgroup_connect() has already
> acquired a reference on the cgroup_subsys_state.
> Drop that reference before returning.
>
> This probably doesn't matter in practice - it only makes a difference if
> a kmalloc allocation fails, with allocation size depending on the cgroup
> nesting depth.
>
> Fixes: c2283c9368d4 ("perf/cgroup: Grow per perf_cpu_context heap storage")
> Signed-off-by: Jann Horn <jannh@xxxxxxxxxx>

I see that on the non-error path the css becomes a cgroup via
container_of that is handed to the event and css_put is in
__free_event/perf_detach_cgroup. Making the error path also css_put
makes sense.

Reviewed-by: Ian Rogers <irogers@xxxxxxxxxx>

Thanks,
Ian

> ---
> I've tested manually that forcing the failure path without this patch
> causes the refcount to go up and stay up, while after applying the
> patch, the refcount drops back to its original value.
> ---
>  kernel/events/core.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/kernel/events/core.c b/kernel/events/core.c
> index 33210aff3ee6..557c950eae06 100644
> --- a/kernel/events/core.c
> +++ b/kernel/events/core.c
> @@ -1143,8 +1143,10 @@ static inline int perf_cgroup_connect(int fd, struct perf_event *event,
>                 return PTR_ERR(css);
>
>         ret = perf_cgroup_ensure_storage(event, css);
> -       if (ret)
> +       if (ret) {
> +               css_put(css);
>                 return ret;
> +       }
>
>         cgrp = container_of(css, struct perf_cgroup, css);
>         event->cgrp = cgrp;
>
> ---
> base-commit: 08df884136f1c1197bab2a27814404fd329d9aac
> change-id: 20260912-perf-cgroup-refleak-b9b7e5417683
>
> Best regards,
> --
> Jann Horn <jannh@xxxxxxxxxx>
>