Hello

Apply the patch on top of 3.5-rc4, and confirmed
the symptom has fixed by your patch.
Thank you!

Tested-by: Masanari Iida <redacted>

Masanari

On Sat, Jun 30, 2012 at 4:07 PM, Li Zefan [off-list ref] wrote:

To avoid rmdir hang, now we won't drain css references at rmdir, but
rmdir will proceed regardless of css refs. We still have to wait till
all css refs have been released before destroying cgroup, and this is
achieved by holding an extra dentry refcnt for each css, which leads to
this bug:

BUG: Dentry ffff8801164db490{i=491b,n=/} still in use (1) [unmount of cgroup cgroup]
------------[ cut here ]------------
kernel BUG at fs/dcache.c:965!
...
Call Trace:
 [<ffffffff811ec19a>] shrink_dcache_for_umount+0x4a/0x90
 [<ffffffff811cc3c7>] generic_shutdown_super+0x37/0x160
 [<ffffffff811cc5d9>] kill_anon_super+0x19/0x40
 [<ffffffff811cc63a>] kill_litter_super+0x3a/0x50
 [<ffffffff810fb65a>] cgroup_kill_sb+0x20a/0x280
 [<ffffffff811ccdc5>] deactivate_locked_super+0x65/0xb0
 [<ffffffff811ce339>] deactivate_super+0x89/0xe0
 [<ffffffff810f7734>] cgroup_d_release+0x34/0x40
 [<ffffffff811eb258>] d_free+0x58/0xc0
 [<ffffffff811ee5f0>] dput+0x220/0x350
 [<ffffffff810f7429>] css_dput_fn+0x19/0x30
 [<ffffffff8107b4d9>] process_one_work+0x239/0x800
 [<ffffffff8107eba3>] worker_thread+0x2e3/0x710
 [<ffffffff81087e46>] kthread+0xd6/0xf0

If there's a css ref dangling after umount, when the ref goes down
to 0, dput will drop the cgroup's dentry and then drop the root
dentry. But kill_sb will be called inbetween, as dropping cgroup dentry
unpinned sb, and now vfs will find the root dentry's refcnt is not 0.

To fix this, we make css pin cgroup instead of cgroup dentry.

Reported-by: Shyju P V <redacted>
Reported-by: Masanari Iida <redacted>
Signed-off-by: Li Zefan <redacted>
---