1 files changed, 10 insertions, 11 deletions

diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 50b94113f4f7..bf30076664ca 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -4396,6 +4396,15 @@ static void css_release_work_fn(struct work_struct *work)
                 /* cgroup release path */
                 cgroup_idr_remove(&cgrp->root->cgroup_idr, cgrp->id);
                 cgrp->id = -1;
+
+                /*
+                 * There are two control paths which try to determine
+                 * cgroup from dentry without going through kernfs -
+                 * cgroupstats_build() and css_tryget_online_from_dir().
+                 * Those are supported by RCU protecting clearing of
+                 * cgrp->kn->priv backpointer.
+                 */
+                RCU_INIT_POINTER(*(void __rcu __force **)&cgrp->kn->priv, NULL);
         }
 
         mutex_unlock(&cgroup_mutex);
@@ -4834,16 +4843,6 @@ static int cgroup_rmdir(struct kernfs_node *kn)
 
         cgroup_kn_unlock(kn);
 
-        /*
-         * There are two control paths which try to determine cgroup from
-         * dentry without going through kernfs - cgroupstats_build() and
-         * css_tryget_online_from_dir().  Those are supported by RCU
-         * protecting clearing of cgrp->kn->priv backpointer, which should
-         * happen after all files under it have been removed.
-         */
-        if (!ret)
-                RCU_INIT_POINTER(*(void __rcu __force **)&kn->priv, NULL);
-
         cgroup_put(cgrp);
         return ret;
 }
@@ -5430,7 +5429,7 @@ struct cgroup_subsys_state *css_tryget_online_from_dir(struct dentry *dentry,
         /*
          * This path doesn't originate from kernfs and @kn could already
          * have been or be removed at any point.  @kn->priv is RCU
-         * protected for this access.  See cgroup_rmdir() for details.
+         * protected for this access.  See css_release_work_fn() for details.
          */
         cgrp = rcu_dereference(kn->priv);
         if (cgrp)