From 785d416ca281051953705b0f10ab56e7b1c0a50a Mon Sep 17 00:00:00 2001
From: "Kirill A. Shutemov" <kirill@shutemov.name>
Date: Wed, 10 Mar 2010 15:22:34 -0800
Subject: [PATCH] --- yaml --- r: 187229 b: refs/heads/master c:
 a0a4db548edcce067c1201ef25cf2bc29f32dca4 h: refs/heads/master i:   187227:
 4af0acb3ced88743e6038eb00a5ae2980cdc5079 v: v3

---
 [refs]                       | 2 +-
 trunk/include/linux/cgroup.h | 3 ---
 trunk/kernel/cgroup.c        | 8 ++++++++
 trunk/mm/memcontrol.c        | 9 ---------
 4 files changed, 9 insertions(+), 13 deletions(-)

diff --git a/[refs] b/[refs]
index fe1b51a3e9b9..cff5821225eb 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 4ab78683c17d739c2a2077141dcf81a02b7fb57e
+refs/heads/master: a0a4db548edcce067c1201ef25cf2bc29f32dca4
diff --git a/trunk/include/linux/cgroup.h b/trunk/include/linux/cgroup.h
index b4f2201321cd..b8ad1ea99586 100644
--- a/trunk/include/linux/cgroup.h
+++ b/trunk/include/linux/cgroup.h
@@ -396,9 +396,6 @@ struct cftype {
 	 * closes the eventfd or on cgroup removing.
 	 * This callback must be implemented, if you want provide
 	 * notification functionality.
-	 *
-	 * Be careful. It can be called after destroy(), so you have
-	 * to keep all nesessary data, until all events are removed.
 	 */
 	int (*unregister_event)(struct cgroup *cgrp, struct cftype *cft,
 			struct eventfd_ctx *eventfd);
diff --git a/trunk/kernel/cgroup.c b/trunk/kernel/cgroup.c
index 87441fc75663..ef909a329750 100644
--- a/trunk/kernel/cgroup.c
+++ b/trunk/kernel/cgroup.c
@@ -2994,6 +2994,7 @@ static void cgroup_event_remove(struct work_struct *work)
 
 	eventfd_ctx_put(event->eventfd);
 	kfree(event);
+	dput(cgrp->dentry);
 }
 
 /*
@@ -3114,6 +3115,13 @@ static int cgroup_write_event_control(struct cgroup *cgrp, struct cftype *cft,
 		goto fail;
 	}
 
+	/*
+	 * Events should be removed after rmdir of cgroup directory, but before
+	 * destroying subsystem state objects. Let's take reference to cgroup
+	 * directory dentry to do that.
+	 */
+	dget(cgrp->dentry);
+
 	spin_lock(&cgrp->event_list_lock);
 	list_add(&event->list, &cgrp->event_list);
 	spin_unlock(&cgrp->event_list_lock);
diff --git a/trunk/mm/memcontrol.c b/trunk/mm/memcontrol.c
index f9ae4b4c36eb..f7b910fc14fb 100644
--- a/trunk/mm/memcontrol.c
+++ b/trunk/mm/memcontrol.c
@@ -3361,12 +3361,6 @@ static int mem_cgroup_register_event(struct cgroup *cgrp, struct cftype *cft,
 		}
 	}
 
-	/*
-	 * We need to increment refcnt to be sure that all thresholds
-	 * will be unregistered before calling __mem_cgroup_free()
-	 */
-	mem_cgroup_get(memcg);
-
 	if (type == _MEM)
 		rcu_assign_pointer(memcg->thresholds, thresholds_new);
 	else
@@ -3460,9 +3454,6 @@ static int mem_cgroup_unregister_event(struct cgroup *cgrp, struct cftype *cft,
 	/* To be sure that nobody uses thresholds before freeing it */
 	synchronize_rcu();
 
-	for (i = 0; i < thresholds->size - size; i++)
-		mem_cgroup_put(memcg);
-
 	kfree(thresholds);
 unlock:
 	mutex_unlock(&memcg->thresholds_lock);