1 files changed, 248 insertions, 0 deletions

diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 13b9d0f221b8..02dae3292668 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -45,6 +45,7 @@
 #include <linux/swapops.h>
 #include <linux/spinlock.h>
 #include <linux/eventfd.h>
+#include <linux/poll.h>
 #include <linux/sort.h>
 #include <linux/fs.h>
 #include <linux/seq_file.h>
@@ -55,6 +56,7 @@
 #include <linux/cpu.h>
 #include <linux/oom.h>
 #include <linux/lockdep.h>
+#include <linux/file.h>
 #include "internal.h"
 #include <net/sock.h>
 #include <net/ip.h>
@@ -226,6 +228,36 @@ struct mem_cgroup_eventfd_list {
         struct eventfd_ctx *eventfd;
 };
 
+/*
+ * cgroup_event represents events which userspace want to receive.
+ */
+struct cgroup_event {
+        /*
+         * css which the event belongs to.
+         */
+        struct cgroup_subsys_state *css;
+        /*
+         * Control file which the event associated.
+         */
+        struct cftype *cft;
+        /*
+         * eventfd to signal userspace about the event.
+         */
+        struct eventfd_ctx *eventfd;
+        /*
+         * Each of these stored in a list by the cgroup.
+         */
+        struct list_head list;
+        /*
+         * All fields below needed to unregister event when
+         * userspace closes eventfd.
+         */
+        poll_table pt;
+        wait_queue_head_t *wqh;
+        wait_queue_t wait;
+        struct work_struct remove;
+};
+
 static void mem_cgroup_threshold(struct mem_cgroup *memcg);
 static void mem_cgroup_oom_notify(struct mem_cgroup *memcg);
 
@@ -5947,6 +5979,202 @@ static void kmem_cgroup_css_offline(struct mem_cgroup *memcg)
 }
 #endif
 
+/*
+ * Unregister event and free resources.
+ *
+ * Gets called from workqueue.
+ */
+static void cgroup_event_remove(struct work_struct *work)
+{
+        struct cgroup_event *event = container_of(work, struct cgroup_event,
+                        remove);
+        struct cgroup_subsys_state *css = event->css;
+
+        remove_wait_queue(event->wqh, &event->wait);
+
+        event->cft->unregister_event(css, event->cft, event->eventfd);
+
+        /* Notify userspace the event is going away. */
+        eventfd_signal(event->eventfd, 1);
+
+        eventfd_ctx_put(event->eventfd);
+        kfree(event);
+        css_put(css);
+}
+
+/*
+ * Gets called on POLLHUP on eventfd when user closes it.
+ *
+ * Called with wqh->lock held and interrupts disabled.
+ */
+static int cgroup_event_wake(wait_queue_t *wait, unsigned mode,
+                int sync, void *key)
+{
+        struct cgroup_event *event = container_of(wait,
+                        struct cgroup_event, wait);
+        struct cgroup *cgrp = event->css->cgroup;
+        unsigned long flags = (unsigned long)key;
+
+        if (flags & POLLHUP) {
+                /*
+                 * If the event has been detached at cgroup removal, we
+                 * can simply return knowing the other side will cleanup
+                 * for us.
+                 *
+                 * We can't race against event freeing since the other
+                 * side will require wqh->lock via remove_wait_queue(),
+                 * which we hold.
+                 */
+                spin_lock(&cgrp->event_list_lock);
+                if (!list_empty(&event->list)) {
+                        list_del_init(&event->list);
+                        /*
+                         * We are in atomic context, but cgroup_event_remove()
+                         * may sleep, so we have to call it in workqueue.
+                         */
+                        schedule_work(&event->remove);
+                }
+                spin_unlock(&cgrp->event_list_lock);
+        }
+
+        return 0;
+}
+
+static void cgroup_event_ptable_queue_proc(struct file *file,
+                wait_queue_head_t *wqh, poll_table *pt)
+{
+        struct cgroup_event *event = container_of(pt,
+                        struct cgroup_event, pt);
+
+        event->wqh = wqh;
+        add_wait_queue(wqh, &event->wait);
+}
+
+/*
+ * Parse input and register new cgroup event handler.
+ *
+ * Input must be in format '<event_fd> <control_fd> <args>'.
+ * Interpretation of args is defined by control file implementation.
+ */
+static int cgroup_write_event_control(struct cgroup_subsys_state *dummy_css,
+                                      struct cftype *cft, const char *buffer)
+{
+        struct cgroup *cgrp = dummy_css->cgroup;
+        struct cgroup_event *event;
+        struct cgroup_subsys_state *cfile_css;
+        unsigned int efd, cfd;
+        struct fd efile;
+        struct fd cfile;
+        char *endp;
+        int ret;
+
+        efd = simple_strtoul(buffer, &endp, 10);
+        if (*endp != ' ')
+                return -EINVAL;
+        buffer = endp + 1;
+
+        cfd = simple_strtoul(buffer, &endp, 10);
+        if ((*endp != ' ') && (*endp != '\0'))
+                return -EINVAL;
+        buffer = endp + 1;
+
+        event = kzalloc(sizeof(*event), GFP_KERNEL);
+        if (!event)
+                return -ENOMEM;
+
+        INIT_LIST_HEAD(&event->list);
+        init_poll_funcptr(&event->pt, cgroup_event_ptable_queue_proc);
+        init_waitqueue_func_entry(&event->wait, cgroup_event_wake);
+        INIT_WORK(&event->remove, cgroup_event_remove);
+
+        efile = fdget(efd);
+        if (!efile.file) {
+                ret = -EBADF;
+                goto out_kfree;
+        }
+
+        event->eventfd = eventfd_ctx_fileget(efile.file);
+        if (IS_ERR(event->eventfd)) {
+                ret = PTR_ERR(event->eventfd);
+                goto out_put_efile;
+        }
+
+        cfile = fdget(cfd);
+        if (!cfile.file) {
+                ret = -EBADF;
+                goto out_put_eventfd;
+        }
+
+        /* the process need read permission on control file */
+        /* AV: shouldn't we check that it's been opened for read instead? */
+        ret = inode_permission(file_inode(cfile.file), MAY_READ);
+        if (ret < 0)
+                goto out_put_cfile;
+
+        event->cft = __file_cft(cfile.file);
+        if (IS_ERR(event->cft)) {
+                ret = PTR_ERR(event->cft);
+                goto out_put_cfile;
+        }
+
+        if (!event->cft->ss) {
+                ret = -EBADF;
+                goto out_put_cfile;
+        }
+
+        /*
+         * Determine the css of @cfile, verify it belongs to the same
+         * cgroup as cgroup.event_control, and associate @event with it.
+         * Remaining events are automatically removed on cgroup destruction
+         * but the removal is asynchronous, so take an extra ref.
+         */
+        rcu_read_lock();
+
+        ret = -EINVAL;
+        event->css = cgroup_css(cgrp, event->cft->ss);
+        cfile_css = css_from_dir(cfile.file->f_dentry->d_parent, event->cft->ss);
+        if (event->css && event->css == cfile_css && css_tryget(event->css))
+                ret = 0;
+
+        rcu_read_unlock();
+        if (ret)
+                goto out_put_cfile;
+
+        if (!event->cft->register_event || !event->cft->unregister_event) {
+                ret = -EINVAL;
+                goto out_put_css;
+        }
+
+        ret = event->cft->register_event(event->css, event->cft,
+                        event->eventfd, buffer);
+        if (ret)
+                goto out_put_css;
+
+        efile.file->f_op->poll(efile.file, &event->pt);
+
+        spin_lock(&cgrp->event_list_lock);
+        list_add(&event->list, &cgrp->event_list);
+        spin_unlock(&cgrp->event_list_lock);
+
+        fdput(cfile);
+        fdput(efile);
+
+        return 0;
+
+out_put_css:
+        css_put(event->css);
+out_put_cfile:
+        fdput(cfile);
+out_put_eventfd:
+        eventfd_ctx_put(event->eventfd);
+out_put_efile:
+        fdput(efile);
+out_kfree:
+        kfree(event);
+
+        return ret;
+}
+
 static struct cftype mem_cgroup_files[] = {
         {
                 .name = "usage_in_bytes",
@@ -5994,6 +6222,12 @@ static struct cftype mem_cgroup_files[] = {
                 .read_u64 = mem_cgroup_hierarchy_read,
         },
         {
+                .name = "cgroup.event_control",
+                .write_string = cgroup_write_event_control,
+                .flags = CFTYPE_NO_PREFIX,
+                .mode = S_IWUGO,
+        },
+        {
                 .name = "swappiness",
                 .read_u64 = mem_cgroup_swappiness_read,
                 .write_u64 = mem_cgroup_swappiness_write,
@@ -6326,6 +6560,20 @@ static void mem_cgroup_invalidate_reclaim_iterators(struct mem_cgroup *memcg)
 static void mem_cgroup_css_offline(struct cgroup_subsys_state *css)
 {
         struct mem_cgroup *memcg = mem_cgroup_from_css(css);
+        struct cgroup *cgrp = css->cgroup;
+        struct cgroup_event *event, *tmp;
+
+        /*
+         * Unregister events and notify userspace.
+         * Notify userspace about cgroup removing only after rmdir of cgroup
+         * directory to avoid race between userspace and kernelspace.
+         */
+        spin_lock(&cgrp->event_list_lock);
+        list_for_each_entry_safe(event, tmp, &cgrp->event_list, list) {
+                list_del_init(&event->list);
+                schedule_work(&event->remove);
+        }
+        spin_unlock(&cgrp->event_list_lock);
 
         kmem_cgroup_css_offline(memcg);