3 files changed, 15 insertions, 29 deletions

diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h
index 02e09c0e98ab..a3098046250b 100644
--- a/include/linux/cgroup.h
+++ b/include/linux/cgroup.h
@@ -85,7 +85,6 @@ struct cgroup_subsys_state {
 /* bits in struct cgroup_subsys_state flags field */
 enum {
         CSS_ROOT, /* This CSS is the root of the subsystem */
-        CSS_REMOVED, /* This CSS is dead */
 };
 
 /* Caller must verify that the css is not for root cgroup */
@@ -108,11 +107,6 @@ static inline void css_get(struct cgroup_subsys_state *css)
                 __css_get(css, 1);
 }
 
-static inline bool css_is_removed(struct cgroup_subsys_state *css)
-{
-        return test_bit(CSS_REMOVED, &css->flags);
-}
-
 /*
  * Call css_tryget() to take a reference on a css if your existing
  * (known-valid) reference isn't already ref-counted. Returns false if
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 8c605e2bdd1a..c194f9e4fc7b 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -170,8 +170,8 @@ struct css_id {
          * The css to which this ID points. This pointer is set to valid value
          * after cgroup is populated. If cgroup is removed, this will be NULL.
          * This pointer is expected to be RCU-safe because destroy()
-         * is called after synchronize_rcu(). But for safe use, css_is_removed()
-         * css_tryget() should be used for avoiding race.
+         * is called after synchronize_rcu(). But for safe use, css_tryget()
+         * should be used for avoiding race.
          */
         struct cgroup_subsys_state __rcu *css;
         /*
@@ -4112,8 +4112,6 @@ static int cgroup_rmdir(struct inode *unused_dir, struct dentry *dentry)
         }
         prepare_to_wait(&cgroup_rmdir_waitq, &wait, TASK_INTERRUPTIBLE);
 
-        local_irq_disable();
-
         /* block new css_tryget() by deactivating refcnt */
         for_each_subsys(cgrp->root, ss) {
                 struct cgroup_subsys_state *css = cgrp->subsys[ss->subsys_id];
@@ -4123,21 +4121,14 @@ static int cgroup_rmdir(struct inode *unused_dir, struct dentry *dentry)
         }
 
         /*
-         * Set REMOVED.  All in-progress css_tryget() will be released.
          * Put all the base refs.  Each css holds an extra reference to the
          * cgroup's dentry and cgroup removal proceeds regardless of css
          * refs.  On the last put of each css, whenever that may be, the
          * extra dentry ref is put so that dentry destruction happens only
          * after all css's are released.
          */
-        for_each_subsys(cgrp->root, ss) {
-                struct cgroup_subsys_state *css = cgrp->subsys[ss->subsys_id];
-
-                set_bit(CSS_REMOVED, &css->flags);
-                css_put(css);
-        }
-
-        local_irq_enable();
+        for_each_subsys(cgrp->root, ss)
+                css_put(cgrp->subsys[ss->subsys_id]);
 
         finish_wait(&cgroup_rmdir_waitq, &wait);
         clear_bit(CGRP_WAIT_ON_RMDIR, &cgrp->flags);
@@ -4861,15 +4852,17 @@ static void check_for_release(struct cgroup *cgrp)
 /* Caller must verify that the css is not for root cgroup */
 bool __css_tryget(struct cgroup_subsys_state *css)
 {
-        do {
-                int v = css_refcnt(css);
+        while (true) {
+                int t, v;
 
-                if (atomic_cmpxchg(&css->refcnt, v, v + 1) == v)
+                v = css_refcnt(css);
+                t = atomic_cmpxchg(&css->refcnt, v, v + 1);
+                if (likely(t == v))
                         return true;
+                else if (t < 0)
+                        return false;
                 cpu_relax();
-        } while (!test_bit(CSS_REMOVED, &css->flags));
-
-        return false;
+        }
 }
 EXPORT_SYMBOL_GPL(__css_tryget);
 
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 5a1d584ffed3..37c356646544 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -2343,7 +2343,6 @@ static int __mem_cgroup_try_charge(struct mm_struct *mm,
 again:
         if (*ptr) { /* css should be a valid one */
                 memcg = *ptr;
-                VM_BUG_ON(css_is_removed(&memcg->css));
                 if (mem_cgroup_is_root(memcg))
                         goto done;
                 if (nr_pages == 1 && consume_stock(memcg))
@@ -2483,9 +2482,9 @@ static void __mem_cgroup_cancel_local_charge(struct mem_cgroup *memcg,
 
 /*
  * A helper function to get mem_cgroup from ID. must be called under
- * rcu_read_lock(). The caller must check css_is_removed() or some if
- * it's concern. (dropping refcnt from swap can be called against removed
- * memcg.)
+ * rcu_read_lock().  The caller is responsible for calling css_tryget if
+ * the mem_cgroup is used for charging. (dropping refcnt from swap can be
+ * called against removed memcg.)
  */
 static struct mem_cgroup *mem_cgroup_lookup(unsigned short id)
 {