]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
cgroup: Increment nr_dying_subsys_* from rmdir context
authorPetr Malat <oss@malat.biz>
Wed, 13 May 2026 16:33:13 +0000 (12:33 -0400)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 17 May 2026 15:16:33 +0000 (17:16 +0200)
commit6d46255ccb188d457116722f3b65e85490ac274b
treed7073eacd09b4689fad3f8029bd38ec666aa4ad0
parent3422529c58c0b38c4e49074c2c07d80b5f9414c8
cgroup: Increment nr_dying_subsys_* from rmdir context

[ Upstream commit 13e786b64bd3fd81c7eb22aa32bf8305c32f2ccf ]

Incrementing nr_dying_subsys_* in offline_css(), which is executed by
cgroup_offline_wq worker, leads to a race where user can see the value
to be 0 if he reads cgroup.stat after calling rmdir and before the worker
executes. This makes the user wrongly expect resources released by the
removed cgroup to be available for a new assignment.

Increment nr_dying_subsys_* from kill_css(), which is called from the
cgroup_rmdir() context.

Fixes: ab0312526867 ("cgroup: Show # of subsystem CSSes in cgroup.stat")
Signed-off-by: Petr Malat <oss@malat.biz>
Signed-off-by: Tejun Heo <tj@kernel.org>
Stable-dep-of: 93618edf7538 ("cgroup: Defer css percpu_ref kill on rmdir until cgroup is depopulated")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
kernel/cgroup/cgroup.c