cgroup2fs: DecRef inodes returned by Lookup for consistency

OrderedChildren.Lookup returns the inode with a ref that the caller is
expected to release (normally by handing it to a dentry via Init). Five
cgroup2fs call sites that look an inode up for a transient purpose
(permission checks, control-file read/write, interface-file removal)
never released that ref.

This is NOT a bug fix: every inode these sites can return
(cgroupInterfaceFile and eventFile, both via kernfs.DynamicBytesFile,
and cgroup directories themselves) embeds kernfs.InodeNoopRefCount, so
IncRef/DecRef are no-ops and nothing leaks today. The change only makes
the ref discipline explicit and correct, so these sites stay safe if a
lookup ever returns a genuinely refcounted inode.

PiperOrigin-RevId: 975402262

Author: shailend-g

pkg/sentry/fsimpl/cgroup2fs/BUILD

@@ -14,6 +14,7 @@ go_library(
         "cpu.go",
         "cpu_mutex.go",
         "cpuset.go",
+        "cpuset_mutex.go",
         "event.go",
         "filesystem.go",
         "memory.go",
@@ -74,3 +75,10 @@ declare_mutex(
     package = "cgroup2fs",
     prefix = "cpu",
 )
+
+declare_mutex(
+    name = "cpuset_mutex",
+    out = "cpuset_mutex.go",
+    package = "cgroup2fs",
+    prefix = "cpuset",
+)

pkg/sentry/fsimpl/cgroup2fs/cgroup.go

@@ -564,6 +564,7 @@ func (c *cgroup) CanCloneInto(ctx context.Context, creds *auth.Credentials, ns *
 	if err != nil {
 		return err
 	}
+	defer inode.DecRef(ctx)
 	if err := inode.CheckPermissions(ctx, creds, vfs.MayWrite); err != nil {
 		return err
 	}
@@ -682,6 +683,7 @@ func (c *cgroup) removeInterfaceFiles(ctx context.Context, ctrl controller) {
 	for _, name := range ctrl.interfaceFileNames() {
 		if inode, err := c.OrderedChildren.Lookup(ctx, name); err == nil {
 			c.OrderedChildren.Unlink(ctx, name, inode)
+			inode.DecRef(ctx)
 		}
 	}
 }
@@ -811,6 +813,7 @@ func (c *cgroup) checkMigrationPermsLocked(ctx context.Context, creds *auth.Cred
 	if err != nil {
 		return err
 	}
+	defer lcaProcs.DecRef(ctx)
 	if err := lcaProcs.CheckPermissions(ctx, creds, vfs.MayWrite); err != nil {
 		return err
 	}
@@ -1163,6 +1166,7 @@ func (c *cgroup) ReadControl(ctx context.Context, name string) (string, error) {
 	if err != nil {
 		return "", fmt.Errorf("no such control file")
 	}
+	defer cfi.DecRef(ctx)
 	dbf, ok := cfi.(*cgroupInterfaceFile)
 	var data vfs.DynamicBytesSource
 	if ok {
@@ -1193,6 +1197,7 @@ func (c *cgroup) WriteControl(ctx context.Context, name string, val string) erro
 	if err != nil {
 		return fmt.Errorf("no such control file")
 	}
+	defer cfi.DecRef(ctx)
 	dbf, ok := cfi.(*cgroupInterfaceFile)
 	if !ok {
 		return fmt.Errorf("control file not writable")

pkg/sentry/fsimpl/cgroup2fs/cpuset.go

@@ -25,7 +25,6 @@ import (
 	"gvisor.dev/gvisor/pkg/hostarch"
 	"gvisor.dev/gvisor/pkg/sentry/kernel"
 	"gvisor.dev/gvisor/pkg/sentry/vfs"
-	"gvisor.dev/gvisor/pkg/sync"
 	"gvisor.dev/gvisor/pkg/usermem"
 )
 
@@ -35,7 +34,7 @@ type cpuset struct {
 	parent   *cpuset
 	detached atomicbitops.Bool
 
-	mu sync.Mutex `state:"nosave"`
+	mu cpusetMutex `state:"nosave"`
 
 	cpus *bitmap.Bitmap
 	mems *bitmap.Bitmap