3 files changed, 22 insertions, 18 deletions

diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h
index ce104e33cd22..38117d937332 100644
--- a/include/linux/cgroup.h
+++ b/include/linux/cgroup.h
@@ -474,7 +474,8 @@ struct cgroup_subsys {
                         struct cgroup *old_cgrp, struct task_struct *tsk,
                         bool threadgroup);
         void (*fork)(struct cgroup_subsys *ss, struct task_struct *task);
-        void (*exit)(struct cgroup_subsys *ss, struct task_struct *task);
+        void (*exit)(struct cgroup_subsys *ss, struct cgroup *cgrp,
+                        struct cgroup *old_cgrp, struct task_struct *task);
         int (*populate)(struct cgroup_subsys *ss,
                         struct cgroup *cgrp);
         void (*post_clone)(struct cgroup_subsys *ss, struct cgroup *cgrp);
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index b24d7027b83c..f6495f33a355 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -4230,20 +4230,8 @@ void cgroup_post_fork(struct task_struct *child)
  */
 void cgroup_exit(struct task_struct *tsk, int run_callbacks)
 {
-        int i;
         struct css_set *cg;
-
-        if (run_callbacks && need_forkexit_callback) {
-                /*
-                 * modular subsystems can't use callbacks, so no need to lock
-                 * the subsys array
-                 */
-                for (i = 0; i < CGROUP_BUILTIN_SUBSYS_COUNT; i++) {
-                        struct cgroup_subsys *ss = subsys[i];
-                        if (ss->exit)
-                                ss->exit(ss, tsk);
-                }
-        }
+        int i;
 
         /*
          * Unlink from the css_set task list if necessary.
@@ -4261,7 +4249,24 @@ void cgroup_exit(struct task_struct *tsk, int run_callbacks)
         task_lock(tsk);
         cg = tsk->cgroups;
         tsk->cgroups = &init_css_set;
+
+        if (run_callbacks && need_forkexit_callback) {
+                /*
+                 * modular subsystems can't use callbacks, so no need to lock
+                 * the subsys array
+                 */
+                for (i = 0; i < CGROUP_BUILTIN_SUBSYS_COUNT; i++) {
+                        struct cgroup_subsys *ss = subsys[i];
+                        if (ss->exit) {
+                                struct cgroup *old_cgrp =
+                                        rcu_dereference_raw(cg->subsys[i])->cgroup;
+                                struct cgroup *cgrp = task_cgroup(tsk, i);
+                                ss->exit(ss, cgrp, old_cgrp, tsk);
+                        }
+                }
+        }
         task_unlock(tsk);
+
         if (cg)
                 put_css_set_taskexit(cg);
 }
diff --git a/kernel/sched.c b/kernel/sched.c
index e142e92f38da..79e611cd83dd 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -606,9 +606,6 @@ static inline struct task_group *task_group(struct task_struct *p)
         struct task_group *tg;
         struct cgroup_subsys_state *css;
 
-        if (p->flags & PF_EXITING)
-                return &root_task_group;
-
         css = task_subsys_state_check(p, cpu_cgroup_subsys_id,
                         lockdep_is_held(&task_rq(p)->lock));
         tg = container_of(css, struct task_group, css);
@@ -8863,7 +8860,8 @@ cpu_cgroup_attach(struct cgroup_subsys *ss, struct cgroup *cgrp,
 }
 
 static void
-cpu_cgroup_exit(struct cgroup_subsys *ss, struct task_struct *task)
+cpu_cgroup_exit(struct cgroup_subsys *ss, struct cgroup *cgrp,
+                struct cgroup *old_cgrp, struct task_struct *task)
 {
         /*
          * cgroup_exit() is called in the copy_process() failure path.