3 files changed, 8 insertions, 12 deletions

diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h
index b4f2201321cd..b8ad1ea99586 100644
--- a/include/linux/cgroup.h
+++ b/include/linux/cgroup.h
@@ -396,9 +396,6 @@ struct cftype {
          * closes the eventfd or on cgroup removing.
          * This callback must be implemented, if you want provide
          * notification functionality.
-         *
-         * Be careful. It can be called after destroy(), so you have
-         * to keep all nesessary data, until all events are removed.
          */
         int (*unregister_event)(struct cgroup *cgrp, struct cftype *cft,
                         struct eventfd_ctx *eventfd);
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 87441fc75663..ef909a329750 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -2994,6 +2994,7 @@ static void cgroup_event_remove(struct work_struct *work)
 
         eventfd_ctx_put(event->eventfd);
         kfree(event);
+        dput(cgrp->dentry);
 }
 
 /*
@@ -3114,6 +3115,13 @@ static int cgroup_write_event_control(struct cgroup *cgrp, struct cftype *cft,
                 goto fail;
         }
 
+        /*
+         * Events should be removed after rmdir of cgroup directory, but before
+         * destroying subsystem state objects. Let's take reference to cgroup
+         * directory dentry to do that.
+         */
+        dget(cgrp->dentry);
+
         spin_lock(&cgrp->event_list_lock);
         list_add(&event->list, &cgrp->event_list);
         spin_unlock(&cgrp->event_list_lock);
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index f9ae4b4c36eb..f7b910fc14fb 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -3361,12 +3361,6 @@ static int mem_cgroup_register_event(struct cgroup *cgrp, struct cftype *cft,
                 }
         }
 
-        /*
-         * We need to increment refcnt to be sure that all thresholds
-         * will be unregistered before calling __mem_cgroup_free()
-         */
-        mem_cgroup_get(memcg);
-
         if (type == _MEM)
                 rcu_assign_pointer(memcg->thresholds, thresholds_new);
         else
@@ -3460,9 +3454,6 @@ assign:
         /* To be sure that nobody uses thresholds before freeing it */
         synchronize_rcu();
 
-        for (i = 0; i < thresholds->size - size; i++)
-                mem_cgroup_put(memcg);
-
         kfree(thresholds);
 unlock:
         mutex_unlock(&memcg->thresholds_lock);