)]}'
{
  "commit": "fd4b4207f1f75c6e71a4e1a9d57f8abc08b300cd",
  "tree": "3f1d6e97f6253d12b889239a1455cb7e6702c1ea",
  "parents": [
    "94a242bd3040e025fd51a39292db753f7291b95b"
  ],
  "author": {
    "name": "Chen Ridong",
    "email": "chenridong@huawei.com",
    "time": "Tue Aug 19 01:07:24 2025 +0000"
  },
  "committer": {
    "name": "Miri Amarilio",
    "email": "mirilio@google.com",
    "time": "Mon Oct 06 11:34:38 2025 -0700"
  },
  "message": "cgroup: split cgroup_destroy_wq into 3 workqueues\n\n[ Upstream commit 79f919a89c9d06816dbdbbd168fa41d27411a7f9 ]\n\nA hung task can occur during [1] LTP cgroup testing when repeatedly\nmounting/unmounting perf_event and net_prio controllers with\nsystemd.unified_cgroup_hierarchy\u003d1. The hang manifests in\ncgroup_lock_and_drain_offline() during root destruction.\n\nRelated case:\ncgroup_fj_function_perf_event cgroup_fj_function.sh perf_event\ncgroup_fj_function_net_prio cgroup_fj_function.sh net_prio\n\nCall Trace:\n\tcgroup_lock_and_drain_offline+0x14c/0x1e8\n\tcgroup_destroy_root+0x3c/0x2c0\n\tcss_free_rwork_fn+0x248/0x338\n\tprocess_one_work+0x16c/0x3b8\n\tworker_thread+0x22c/0x3b0\n\tkthread+0xec/0x100\n\tret_from_fork+0x10/0x20\n\nRoot Cause:\n\nCPU0                            CPU1\nmount perf_event                umount net_prio\ncgroup1_get_tree                cgroup_kill_sb\nrebind_subsystems               // root destruction enqueues\n\t\t\t\t// cgroup_destroy_wq\n// kill all perf_event css\n                                // one perf_event css A is dying\n                                // css A offline enqueues cgroup_destroy_wq\n                                // root destruction will be executed first\n                                css_free_rwork_fn\n                                cgroup_destroy_root\n                                cgroup_lock_and_drain_offline\n                                // some perf descendants are dying\n                                // cgroup_destroy_wq max_active \u003d 1\n                                // waiting for css A to die\n\nProblem scenario:\n1. CPU0 mounts perf_event (rebind_subsystems)\n2. CPU1 unmounts net_prio (cgroup_kill_sb), queuing root destruction work\n3. A dying perf_event CSS gets queued for offline after root destruction\n4. Root destruction waits for offline completion, but offline work is\n   blocked behind root destruction in cgroup_destroy_wq (max_active\u003d1)\n\nSolution:\nSplit cgroup_destroy_wq into three dedicated workqueues:\ncgroup_offline_wq – Handles CSS offline operations\ncgroup_release_wq – Manages resource release\ncgroup_free_wq – Performs final memory deallocation\n\nThis separation eliminates blocking in the CSS free path while waiting for\noffline operations to complete.\n\n[1] https://github.com/linux-test-project/ltp/blob/master/runtest/controllers\nBUG\u003db/449343090\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dFixed CVE-2025-39953 in the Linux kernel.\n\ncos-patch: security-moderate\nFixes: 334c3679ec4b (\"cgroup: reimplement rebind_subsystems() using cgroup_apply_control() and friends\")\nReported-by: Gao Yingjie \u003cgaoyingjie@uniontech.com\u003e\nChange-Id: I3a8be9be5647283a58e2580f36591e6b3ab1d5d2\nSigned-off-by: Chen Ridong \u003cchenridong@huawei.com\u003e\nSuggested-by: Teju Heo \u003ctj@kernel.org\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\nSigned-off-by: Kernel CVE Triage Automation \u003ccloud-image-kernel-cve-triage-automation@prod.google.com\u003e\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/113501\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\nReviewed-by: Kevin Berry \u003ckpberry@google.com\u003e\nReviewed-by: Miri Amarilio \u003cmirilio@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "e8ef062f6ca058f4682f9bed60e2578ec3108480",
      "old_mode": 33188,
      "old_path": "kernel/cgroup/cgroup.c",
      "new_id": "5135838b5899f885bb66b1e2aa521ce745a2d67f",
      "new_mode": 33188,
      "new_path": "kernel/cgroup/cgroup.c"
    }
  ]
}