Re: [PATCH] cgroup: Move cgroup_task_dead() to task_struct clean up

[Sebastian Andrzej Siewior <bigeasy@linutronix.de>]

On 2026-03-15 10:15:41 [-1000], Tejun Heo wrote:
> Hello,
Hi,

> Yeah, I think it's too late. That's where we tell the cgroup is becoming
> empty among other things. cgroup_task_free() waits for all task refcnts to
> drop which can take any amount of time. You can also imagine situations
> where e.g. userspace pins a specific task through pidfd unitl the cgroup it
> belongs becomes empty, which would have worked before but now would
> deadlock.

I see. What about moving it to delayed_put_task_struct() such as the
change on top below? It also RCU and only acquired by bpf_task_acquire().
Is this also a concern or would that work?

--- a/include/linux/cgroup.h
+++ b/include/linux/cgroup.h
@@ -138,6 +138,7 @@ extern void cgroup_cancel_fork(struct task_struct *p,
 extern void cgroup_post_fork(struct task_struct *p,
 			     struct kernel_clone_args *kargs);
 void cgroup_task_exit(struct task_struct *p);
+void cgroup_task_dead(struct task_struct *p);
 void cgroup_task_release(struct task_struct *p);
 void cgroup_task_free(struct task_struct *p);
 
@@ -681,6 +682,7 @@ static inline void cgroup_cancel_fork(struct task_struct *p,
 static inline void cgroup_post_fork(struct task_struct *p,
 				    struct kernel_clone_args *kargs) {}
 static inline void cgroup_task_exit(struct task_struct *p) {}
+static inline void cgroup_task_dead(struct task_struct *p) {}
 static inline void cgroup_task_release(struct task_struct *p) {}
 static inline void cgroup_task_free(struct task_struct *p) {}
 
diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
index 684b773cd5cb4..28cdb8d3210e7 100644
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -6991,7 +6991,7 @@ void cgroup_task_exit(struct task_struct *tsk)
 	} while_each_subsys_mask();
 }
 
-static void cgroup_task_dead(struct task_struct *tsk)
+void cgroup_task_dead(struct task_struct *tsk)
 {
 	struct css_set *cset;
 	unsigned long flags;
@@ -7031,7 +7031,6 @@ void cgroup_task_free(struct task_struct *task)
 {
 	struct css_set *cset = task_css_set(task);
 
-	cgroup_task_dead(task);
 	if (!list_empty(&task->cg_list)) {
 		spin_lock_irq(&css_set_lock);
 		css_set_skip_task_iters(task_css_set(task), task);
diff --git a/kernel/exit.c b/kernel/exit.c
index ede3117fa7d41..7a94425122238 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -228,6 +228,7 @@ static void delayed_put_task_struct(struct rcu_head *rhp)
 	rethook_flush_task(tsk);
 	perf_event_delayed_put(tsk);
 	trace_sched_process_free(tsk);
+	cgroup_task_dead(tsk);
 	put_task_struct(tsk);
 }
 

> Thanks.

Sebastian