Patch "cgroup: remove redundant cleanup in css_create" has been added to the 4.6-stable tree

This is a note to let you know that I've just added the patch titled

cgroup: remove redundant cleanup in css_create

to the 4.6-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
cgroup-remove-redundant-cleanup-in-css_create.patch
and it can be found in the queue-4.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Wenwei Tao <[email protected]>
Date: Fri, 13 May 2016 22:59:20 +0800
Subject: cgroup: remove redundant cleanup in css_create

From: Wenwei Tao <[email protected]>

commit b00c52dae6d9ee8d0f2407118ef6544ae5524781 upstream.

When create css failed, before call css_free_rcu_fn, we remove the css id and exit the percpu_ref, but we will do these again in css_free_work_fn, so they are redundant. Especially the css id, that would cause problem if we remove it twice, since it may be assigned to another css after the first remove.

tj: This was broken by two commits updating the free path without
synchronizing the creation failure path. This can be easily triggered by trying to create more than 64k memory cgroups.

---
 kernel/cgroup.c |    5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

@@ -5150,7 +5150,7 @@ static struct cgroup_subsys_state *css_c
 
 	err = cgroup_idr_alloc(&ss->css_idr, NULL, 2, 0, GFP_KERNEL);
 	if (err < 0)
-		goto err_free_percpu_ref;
+		goto err_free_css;
 	css->id = err;
 
 	/* @css is ready to be brought online now, make it visible */

@@ -5174,9 +5174,6 @@ static struct cgroup_subsys_state *css_c
 
 err_list_del:
 	list_del_rcu(&css->sibling);
-	cgroup_idr_remove(&ss->css_idr, css->id);
-err_free_percpu_ref:
-	percpu_ref_exit(&css->refcnt);
 err_free_css:
 	call_rcu(&css->rcu_head, css_free_rcu_fn);
 	return ERR_PTR(err);

Patches currently in stable-queue which might be from [email protected] are

queue-4.6/cgroup-set-css-id-to-1-during-init.patch queue-4.6/cgroup-remove-redundant-cleanup-in-css_create.patch