2 files changed, 20 insertions, 16 deletions

diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h
index 5c097596104b..9450f025fe0c 100644
--- a/include/linux/cgroup.h
+++ b/include/linux/cgroup.h
@@ -166,6 +166,8 @@ struct cgroup {
          *
          * The ID of the root cgroup is always 0, and a new cgroup
          * will be assigned with a smallest available ID.
+         *
+         * Allocating/Removing ID must be protected by cgroup_mutex.
          */
         int id;
 
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 3edf7163b84f..52719ce55dd3 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -886,7 +886,9 @@ static void cgroup_diput(struct dentry *dentry, struct inode *inode)
                  * per-subsystem and moved to css->id so that lookups are
                  * successful until the target css is released.
                  */
+                mutex_lock(&cgroup_mutex);
                 idr_remove(&cgrp->root->cgroup_idr, cgrp->id);
+                mutex_unlock(&cgroup_mutex);
                 cgrp->id = -1;
 
                 call_rcu(&cgrp->rcu_head, cgroup_free_rcu);
@@ -4168,16 +4170,6 @@ static long cgroup_create(struct cgroup *parent, struct dentry *dentry,
         rcu_assign_pointer(cgrp->name, name);
 
         /*
-         * Temporarily set the pointer to NULL, so idr_find() won't return
-         * a half-baked cgroup.
-         */
-        cgrp->id = idr_alloc(&root->cgroup_idr, NULL, 1, 0, GFP_KERNEL);
-        if (cgrp->id < 0) {
-                err = -ENOMEM;
-                goto err_free_name;
-        }
-
-        /*
          * Only live parents can have children.  Note that the liveliness
          * check isn't strictly necessary because cgroup_mkdir() and
          * cgroup_rmdir() are fully synchronized by i_mutex; however, do it
@@ -4186,7 +4178,17 @@ static long cgroup_create(struct cgroup *parent, struct dentry *dentry,
          */
         if (!cgroup_lock_live_group(parent)) {
                 err = -ENODEV;
-                goto err_free_id;
+                goto err_free_name;
+        }
+
+        /*
+         * Temporarily set the pointer to NULL, so idr_find() won't return
+         * a half-baked cgroup.
+         */
+        cgrp->id = idr_alloc(&root->cgroup_idr, NULL, 1, 0, GFP_KERNEL);
+        if (cgrp->id < 0) {
+                err = -ENOMEM;
+                goto err_unlock;
         }
 
         /* Grab a reference on the superblock so the hierarchy doesn't
@@ -4218,7 +4220,7 @@ static long cgroup_create(struct cgroup *parent, struct dentry *dentry,
          */
         err = cgroup_create_file(dentry, S_IFDIR | mode, sb);
         if (err < 0)
-                goto err_unlock;
+                goto err_free_id;
         lockdep_assert_held(&dentry->d_inode->i_mutex);
 
         cgrp->serial_nr = cgroup_serial_nr_next++;
@@ -4254,12 +4256,12 @@ static long cgroup_create(struct cgroup *parent, struct dentry *dentry,
 
         return 0;
 
-err_unlock:
-        mutex_unlock(&cgroup_mutex);
-        /* Release the reference count that we took on the superblock */
-        deactivate_super(sb);
 err_free_id:
         idr_remove(&root->cgroup_idr, cgrp->id);
+        /* Release the reference count that we took on the superblock */
+        deactivate_super(sb);
+err_unlock:
+        mutex_unlock(&cgroup_mutex);
 err_free_name:
         kfree(rcu_dereference_raw(cgrp->name));
 err_free_cgrp: