Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   =?UTF-8?q?Michal=20Koutn=C3=BD?= <mkoutny@suse.com>
To:     cgroups@vger.kernel.org, linux-kernel@vger.kernel.org
Cc:     Tejun Heo <tj@kernel.org>, Zefan Li <lizefan.x@bytedance.com>,
        Johannes Weiner <hannes@cmpxchg.org>,
        Bui Quang Minh <minhquangbui99@gmail.com>,
        Tadeusz Struk <tadeusz.struk@linaro.org>
Subject: [PATCH 0/2] cgroup_subsys_state lifecycle fixups
Date:   Wed, 25 May 2022 17:15:15 +0200
Message-Id: <20220525151517.8430-1-mkoutny@suse.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Precedence: bulk

Two corner cases were hanging around [2][3] related to css lifecycles,
since they're loosely related I'm sending them together.

The 2nd patch fixes problems encountered in syzbot tests only.
Alternative solutions could be:
- daisy-chain css_release_work_fn from the offending css_killed_work_fn call,
- rework kill_css() not to rely on multi-stage css_killed_work_fn() [1].

The simplest approach was chosen.

The other existing users of percpu_ref_kill_and_confirm are not affected by
similar issues.

[1] Rough idea is to only synchronize via a completion like e.g.
nvmet_sq_destroy() does and move most of css_killed_work_fn() at the end of
kill_css(). kill_css() is only used in process context when de-configuring
controllers or rmdiring a cgroup.

[2] https://lore.kernel.org/lkml/20220404142535.145975-1-minhquangbui99@gmail.com/
[3] https://lore.kernel.org/lkml/20220412192459.227740-1-tadeusz.struk@linaro.org/

Michal Koutný (2):
  cgroup: Wait for cgroup_subsys_state offlining on unmount
  cgroup: Use separate work structs on css release path

 include/linux/cgroup-defs.h |  5 +++--
 kernel/cgroup/cgroup.c      | 19 +++++++++++--------
 2 files changed, 14 insertions(+), 10 deletions(-)

-- 
2.35.3