Re: [PATCH] cgroup: free cset links on find_css_set() failure

Re: [PATCH] cgroup: free cset links on find_css_set() failure

[Tejun Heo]

Hello,

[This is an AI-assisted review.]

On Wed, Feb 18, 2026 at 05:35:43PM +0530, Kaushlendra Kumar wrote:
> When the recursive find_css_set() call for the domain
> cset fails, tmp_links allocated earlier are not freed,
> causing a memory leak.
>
> Free tmp_links before returning NULL to prevent the leak.

tmp_links entries are consumed by link_css_set() which list_move_tail()'s each
entry off tmp_links and into cgrp->cset_links and cset->cgrp_links. The
BUG_ON(!list_empty(&tmp_links)) right after the linking loop (line 1281)
confirms that tmp_links is empty by the time we reach the threaded cset
handling code below.

The links, now owned by cset->cgrp_links, are properly freed by
put_css_set(cset) which is already called on this error path.

So the added free_cgrp_cset_links() call would just iterate an empty list and
is a no-op. There is no leak here.

Thanks.

--
tejun

RE: [PATCH] cgroup: free cset links on find_css_set() failure

[Kumar, Kaushlendra]

On <date>, Tejun Heo <tj@kernel.org> wrote:
> tmp_links entries are consumed by link_css_set() which
> list_move_tail()'s each entry off tmp_links and into
> cgrp->cset_links and cset->cgrp_links. The BUG_ON
> (!list_empty(&tmp_links)) right after the linking loop
> (line 1281) confirms that tmp_links is empty by the
> time we reach the threaded cset handling code below.
>
> The links, now owned by cset->cgrp_links, are properly
> freed by put_css_set(cset) which is already called on
> this error path.
>
> So the added free_cgrp_cset_links() call would just
> iterate an empty list and is a no-op. There is no leak
> here.

You are right. 
put_css_set() already handles the cleanup.

The added call is indeed a no-op. Dropping this patch.

BR,
Kaushlendra