1 files changed, 14 insertions, 7 deletions

diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 358e77564e6f..fe00b3b983a8 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -2039,10 +2039,13 @@ int cgroupstats_build(struct cgroupstats *stats, struct dentry *dentry)
         struct cgroup *cgrp;
         struct cgroup_iter it;
         struct task_struct *tsk;
+
         /*
-         * Validate dentry by checking the superblock operations
+         * Validate dentry by checking the superblock operations,
+         * and make sure it's a directory.
          */
-        if (dentry->d_sb->s_op != &cgroup_ops)
+        if (dentry->d_sb->s_op != &cgroup_ops ||
+            !S_ISDIR(dentry->d_inode->i_mode))
                  goto err;
 
         ret = 0;
@@ -2472,10 +2475,7 @@ static int cgroup_rmdir(struct inode *unused_dir, struct dentry *dentry)
                 mutex_unlock(&cgroup_mutex);
                 return -EBUSY;
         }
-
-        parent = cgrp->parent;
-        root = cgrp->root;
-        sb = root->sb;
+        mutex_unlock(&cgroup_mutex);
 
         /*
          * Call pre_destroy handlers of subsys. Notify subsystems
@@ -2483,7 +2483,14 @@ static int cgroup_rmdir(struct inode *unused_dir, struct dentry *dentry)
          */
         cgroup_call_pre_destroy(cgrp);
 
-        if (cgroup_has_css_refs(cgrp)) {
+        mutex_lock(&cgroup_mutex);
+        parent = cgrp->parent;
+        root = cgrp->root;
+        sb = root->sb;
+
+        if (atomic_read(&cgrp->count)
+            || !list_empty(&cgrp->children)
+            || cgroup_has_css_refs(cgrp)) {
                 mutex_unlock(&cgroup_mutex);
                 return -EBUSY;
         }