1 files changed, 11 insertions, 3 deletions

diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index ce7a8cc7b404..5b6b0039f725 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -1127,8 +1127,8 @@ skip_node:
          * skipping css reference should be safe.
          */
         if (next_css) {
-                if ((next_css->flags & CSS_ONLINE) &&
-                                (next_css == &root->css || css_tryget(next_css)))
+                if ((next_css == &root->css) ||
+                    ((next_css->flags & CSS_ONLINE) && css_tryget(next_css)))
                         return mem_cgroup_from_css(next_css);
 
                 prev_css = next_css;
@@ -6595,6 +6595,7 @@ static void mem_cgroup_css_offline(struct cgroup_subsys_state *css)
 {
         struct mem_cgroup *memcg = mem_cgroup_from_css(css);
         struct mem_cgroup_event *event, *tmp;
+        struct cgroup_subsys_state *iter;
 
         /*
          * Unregister events and notify userspace.
@@ -6611,7 +6612,14 @@ static void mem_cgroup_css_offline(struct cgroup_subsys_state *css)
         kmem_cgroup_css_offline(memcg);
 
         mem_cgroup_invalidate_reclaim_iterators(memcg);
-        mem_cgroup_reparent_charges(memcg);
+
+        /*
+         * This requires that offlining is serialized.  Right now that is
+         * guaranteed because css_killed_work_fn() holds the cgroup_mutex.
+         */
+        css_for_each_descendant_post(iter, css)
+                mem_cgroup_reparent_charges(mem_cgroup_from_css(iter));
+
         mem_cgroup_destroy_all_caches(memcg);
         vmpressure_cleanup(&memcg->vmpressure);
 }