Hello,

On Thu, Sep 06, 2018 at 05:10:42PM -0400, Dennis Zhou wrote:

+struct cgroup_subsys_state *cgroup_e_css(struct cgroup *cgrp,
+					 struct cgroup_subsys *ss)
+{
+	struct cgroup_subsys_state *css;
+
+	rcu_read_lock();
+
+	do {
+		css = cgroup_css(cgrp, ss);
+
+		if (css)
+			goto out_unlock;
+		cgrp = cgroup_parent(cgrp);
+	} while (cgrp);
+
+	css = init_css_set.subsys[ss->id];
+out_unlock:
+	rcu_read_unlock();

Nothing protects @css here tho.  It can be released before the caller
is done with it.  The caller must ensure that it's holding rcu read
lock to protect the lookup and the subsequent uses.  cgroup_css()
already checks for rcu locking, so if you just drop
rcu_read_lock/unlock(), everything should work fine.

Thanks.

-- 
tejun