cgroup: avoid attaching a cgroup root to two different superblocks, take 2

Commit bfb0b80db5f9 ("cgroup: avoid attaching a cgroup root to two
different superblocks") is broken.  Now we try to fix the race by
delaying the initialization of cgroup root refcnt until a superblock
has been allocated.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Reported-by: Andrei Vagin <avagin@virtuozzo.com>
Tested-by: Andrei Vagin <avagin@virtuozzo.com>
Signed-off-by: Zefan Li <lizefan@huawei.com>
Signed-off-by: Tejun Heo <tj@kernel.org>

1 files changed, 4 insertions, 4 deletions

diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
index 10951d5e35d2..38d9386f46e7 100644
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -1645,7 +1645,7 @@ void init_cgroup_root(struct cgroup_root *root, struct cgroup_sb_opts *opts)
                 set_bit(CGRP_CPUSET_CLONE_CHILDREN, &root->cgrp.flags);
 }
 
-int cgroup_setup_root(struct cgroup_root *root, u16 ss_mask)
+int cgroup_setup_root(struct cgroup_root *root, u16 ss_mask, int ref_flags)
 {
         LIST_HEAD(tmp_links);
         struct cgroup *root_cgrp = &root->cgrp;
@@ -1661,8 +1661,8 @@ int cgroup_setup_root(struct cgroup_root *root, u16 ss_mask)
         root_cgrp->id = ret;
         root_cgrp->ancestor_ids[0] = ret;
 
-        ret = percpu_ref_init(&root_cgrp->self.refcnt, css_release, 0,
-                              GFP_KERNEL);
+        ret = percpu_ref_init(&root_cgrp->self.refcnt, css_release,
+                              ref_flags, GFP_KERNEL);
         if (ret)
                 goto out;
 
@@ -4517,7 +4517,7 @@ int __init cgroup_init(void)
         hash_add(css_set_table, &init_css_set.hlist,
                  css_set_hash(init_css_set.subsys));
 
-        BUG_ON(cgroup_setup_root(&cgrp_dfl_root, 0));
+        BUG_ON(cgroup_setup_root(&cgrp_dfl_root, 0, 0));
 
         mutex_unlock(&cgroup_mutex);