[PATCH] cgroup: free cset links on find_css_set() failure

[PATCH] cgroup: free cset links on find_css_set() failure

[Kaushlendra Kumar]

When the recursive find_css_set() call for the domain
cset fails, tmp_links allocated earlier are not freed,
causing a memory leak.

Free tmp_links before returning NULL to prevent the leak.

Fixes: 454000adaa2a ("cgroup: introduce cgroup->dom_cgrp and threaded css_set handling")

Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
---
 kernel/cgroup/cgroup.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
index 5f0d33b04910..b1f66311e8d3 100644
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -1308,6 +1308,7 @@ static struct css_set *find_css_set(struct css_set *old_cset,
 		dcset = find_css_set(cset, cset->dfl_cgrp->dom_cgrp);
 		if (!dcset) {
 			put_css_set(cset);
+			free_cgrp_cset_links(&tmp_links);
 			return NULL;
 		}
 
-- 
2.34.1

Re: [PATCH] cgroup: free cset links on find_css_set() failure

[Tejun Heo]

Hello,

[This is an AI-assisted review.]

On Wed, Feb 18, 2026 at 05:35:43PM +0530, Kaushlendra Kumar wrote:
> When the recursive find_css_set() call for the domain
> cset fails, tmp_links allocated earlier are not freed,
> causing a memory leak.
>
> Free tmp_links before returning NULL to prevent the leak.

tmp_links entries are consumed by link_css_set() which list_move_tail()'s each
entry off tmp_links and into cgrp->cset_links and cset->cgrp_links. The
BUG_ON(!list_empty(&tmp_links)) right after the linking loop (line 1281)
confirms that tmp_links is empty by the time we reach the threaded cset
handling code below.

The links, now owned by cset->cgrp_links, are properly freed by
put_css_set(cset) which is already called on this error path.

So the added free_cgrp_cset_links() call would just iterate an empty list and
is a no-op. There is no leak here.

Thanks.

--
tejun

RE: [PATCH] cgroup: free cset links on find_css_set() failure

[Kumar, Kaushlendra]

On <date>, Tejun Heo <tj@kernel.org> wrote:
> tmp_links entries are consumed by link_css_set() which
> list_move_tail()'s each entry off tmp_links and into
> cgrp->cset_links and cset->cgrp_links. The BUG_ON
> (!list_empty(&tmp_links)) right after the linking loop
> (line 1281) confirms that tmp_links is empty by the
> time we reach the threaded cset handling code below.
>
> The links, now owned by cset->cgrp_links, are properly
> freed by put_css_set(cset) which is already called on
> this error path.
>
> So the added free_cgrp_cset_links() call would just
> iterate an empty list and is a no-op. There is no leak
> here.

You are right. 
put_css_set() already handles the cleanup.

The added call is indeed a no-op. Dropping this patch.

BR,
Kaushlendra