[PATCH] cgroup/freezer: walk exiting tasks in the v1 freezer

[PATCH] cgroup/freezer: walk exiting tasks in the v1 freezer

[Mani Tofigh via B4 Relay]

From: Mani Tofigh <mt4022@columbia.edu>

An exiting task can stay frozen after its v1 freezer cgroup is thawed.
Since commit a72f73c4dd9b ("cgroup: Don't expose dead tasks in cgroup")
the css task walk hides an exiting task once its process has no live
threads left.  That count drops when another thread of the process
exits, which can happen between the freeze and the thaw walk.  A pid
namespace init hits this easily since it waits freezably in
zap_pid_ns_processes() after commit 81933038f5e2 ("pid_namespace: make
zap_pid_ns_processes() freezable"):

  Task A (pid ns init)      Task B (A's thread)      Task C
                            do_exit()
                              exit_signals()
  do_exit()
    zap_pid_ns_processes()
                                                     write FROZEN
                                                       /* A frozen */
                              /* live count 0 */
                                                     write THAWED
                                                       /* A skipped */

A then stays frozen even after SIGKILL:

  [   10.775155] task:fz-init         state:D stack:28152 pid:65    tgid:65    ppid:1      task_flags:0xc0004c flags:0x00080000
  [   10.775176] Call Trace:
  [   10.775180]  <TASK>
  [   10.775188]  __schedule+0x10f1/0x4760
  [   10.775252]  schedule+0xd7/0x2c0
  [   10.775265]  zap_pid_ns_processes+0x2c7/0x5f0
  [   10.775346]  do_exit+0x1bf4/0x2560
  [   10.775403]  __x64_sys_exit+0x3d/0x50
  [   10.775414]  x64_sys_call+0x156c/0x1570
  [   10.775425]  do_syscall_64+0xfb/0x590
  [   10.775450]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
  [   10.775529]  </TASK>

Use CSS_TASK_ITER_WITH_DEAD in the three v1 freezer walks so they all
see the same tasks, as commit 60f21a264930 ("cgroup, sched_ext: Include
exiting tasks in cgroup iter") did for sched_ext.  With the fix, A is
thawed and exits.

This bug was identified and confirmed with the help of a deterministic
hypervisor currently under development.  The C reproducer below however
hits it within about 10s.

Fixes: a72f73c4dd9b ("cgroup: Don't expose dead tasks in cgroup")
Cc: stable@vger.kernel.org
Signed-off-by: Mani Tofigh <mt4022@columbia.edu>
---
Reproducer: https://github.com/manitofigh/files/blob/main/linux-repros/freezev1.c
---
 kernel/cgroup/legacy_freezer.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/kernel/cgroup/legacy_freezer.c b/kernel/cgroup/legacy_freezer.c
index 8545e0d1ba3d..bd11047f2311 100644
--- a/kernel/cgroup/legacy_freezer.c
+++ b/kernel/cgroup/legacy_freezer.c
@@ -265,7 +265,7 @@ static void update_if_frozen(struct cgroup_subsys_state *css)
 	rcu_read_unlock();
 
 	/* are all tasks frozen? */
-	css_task_iter_start(css, 0, &it);
+	css_task_iter_start(css, CSS_TASK_ITER_WITH_DEAD, &it);
 
 	while ((task = css_task_iter_next(&it))) {
 		if (freezing(task) && !frozen(task))
@@ -309,7 +309,7 @@ static void freeze_cgroup(struct freezer *freezer)
 	struct css_task_iter it;
 	struct task_struct *task;
 
-	css_task_iter_start(&freezer->css, 0, &it);
+	css_task_iter_start(&freezer->css, CSS_TASK_ITER_WITH_DEAD, &it);
 	while ((task = css_task_iter_next(&it)))
 		freeze_task(task);
 	css_task_iter_end(&it);
@@ -320,7 +320,7 @@ static void unfreeze_cgroup(struct freezer *freezer)
 	struct css_task_iter it;
 	struct task_struct *task;
 
-	css_task_iter_start(&freezer->css, 0, &it);
+	css_task_iter_start(&freezer->css, CSS_TASK_ITER_WITH_DEAD, &it);
 	while ((task = css_task_iter_next(&it)))
 		__thaw_task(task);
 	css_task_iter_end(&it);

---
base-commit: fffbdad76a57eed26cff1be19f4cbb407f0b6e7c
change-id: 20261102-cgroup-freezer-exiting-c7f60e4c3200

Best regards,
--  
Mani Tofigh <mt4022@columbia.edu>

Re: [PATCH] cgroup/freezer: walk exiting tasks in the v1 freezer

[Tao Cui]

Hi Mani,

在 2026/11/4 02:09, Mani Tofigh via B4 Relay 写道:
> From: Mani Tofigh <mt4022@columbia.edu>
> 
> An exiting task can stay frozen after its v1 freezer cgroup is thawed.
> Since commit a72f73c4dd9b ("cgroup: Don't expose dead tasks in cgroup")
> the css task walk hides an exiting task once its process has no live
> threads left.  That count drops when another thread of the process
> exits, which can happen between the freeze and the thaw walk.  A pid
> namespace init hits this easily since it waits freezably in
> zap_pid_ns_processes() after commit 81933038f5e2 ("pid_namespace: make
> zap_pid_ns_processes() freezable"):
> 
>   Task A (pid ns init)      Task B (A's thread)      Task C
>                             do_exit()
>                               exit_signals()
>   do_exit()
>     zap_pid_ns_processes()
>                                                      write FROZEN
>                                                        /* A frozen */
>                               /* live count 0 */
>                                                      write THAWED
>                                                        /* A skipped */
> 
> A then stays frozen even after SIGKILL:
> 
>   [   10.775155] task:fz-init         state:D stack:28152 pid:65    tgid:65    ppid:1      task_flags:0xc0004c flags:0x00080000
>   [   10.775176] Call Trace:
>   [   10.775180]  <TASK>
>   [   10.775188]  __schedule+0x10f1/0x4760
>   [   10.775252]  schedule+0xd7/0x2c0
>   [   10.775265]  zap_pid_ns_processes+0x2c7/0x5f0
>   [   10.775346]  do_exit+0x1bf4/0x2560
>   [   10.775403]  __x64_sys_exit+0x3d/0x50
>   [   10.775414]  x64_sys_call+0x156c/0x1570
>   [   10.775425]  do_syscall_64+0xfb/0x590
>   [   10.775450]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
>   [   10.775529]  </TASK>
> 
> Use CSS_TASK_ITER_WITH_DEAD in the three v1 freezer walks so they all
> see the same tasks, as commit 60f21a264930 ("cgroup, sched_ext: Include
> exiting tasks in cgroup iter") did for sched_ext.  With the fix, A is
> thawed and exits.
> 

Thanks for the clear writeup and reproducer. Ran freezev1.c against
next-20261103 on a 2-vCPU VM. Base reproduced the hang on round 1
(5.1s), with the patch 600s / 6124 rounds ran clean.

Reviewed-by: Tao Cui <cuitao@kylinos.cn>
Tested-by: Tao Cui <cuitao@kylinos.cn>

Thanks,
Tao
> This bug was identified and confirmed with the help of a deterministic
> hypervisor currently under development.  The C reproducer below however
> hits it within about 10s.
> 
> Fixes: a72f73c4dd9b ("cgroup: Don't expose dead tasks in cgroup")
> Cc: stable@vger.kernel.org
> Signed-off-by: Mani Tofigh <mt4022@columbia.edu>
> ---
> Reproducer: https://github.com/manitofigh/files/blob/main/linux-repros/freezev1.c
> ---
>  kernel/cgroup/legacy_freezer.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/kernel/cgroup/legacy_freezer.c b/kernel/cgroup/legacy_freezer.c
> index 8545e0d1ba3d..bd11047f2311 100644
> --- a/kernel/cgroup/legacy_freezer.c
> +++ b/kernel/cgroup/legacy_freezer.c
> @@ -265,7 +265,7 @@ static void update_if_frozen(struct cgroup_subsys_state *css)
>  	rcu_read_unlock();
>  
>  	/* are all tasks frozen? */
> -	css_task_iter_start(css, 0, &it);
> +	css_task_iter_start(css, CSS_TASK_ITER_WITH_DEAD, &it);
>  
>  	while ((task = css_task_iter_next(&it))) {
>  		if (freezing(task) && !frozen(task))
> @@ -309,7 +309,7 @@ static void freeze_cgroup(struct freezer *freezer)
>  	struct css_task_iter it;
>  	struct task_struct *task;
>  
> -	css_task_iter_start(&freezer->css, 0, &it);
> +	css_task_iter_start(&freezer->css, CSS_TASK_ITER_WITH_DEAD, &it);
>  	while ((task = css_task_iter_next(&it)))
>  		freeze_task(task);
>  	css_task_iter_end(&it);
> @@ -320,7 +320,7 @@ static void unfreeze_cgroup(struct freezer *freezer)
>  	struct css_task_iter it;
>  	struct task_struct *task;
>  
> -	css_task_iter_start(&freezer->css, 0, &it);
> +	css_task_iter_start(&freezer->css, CSS_TASK_ITER_WITH_DEAD, &it);
>  	while ((task = css_task_iter_next(&it)))
>  		__thaw_task(task);
>  	css_task_iter_end(&it);
> 
> ---
> base-commit: fffbdad76a57eed26cff1be19f4cbb407f0b6e7c
> change-id: 20261102-cgroup-freezer-exiting-c7f60e4c3200
> 
> Best regards,
> --  
> Mani Tofigh <mt4022@columbia.edu>

Re: [PATCH] cgroup/freezer: walk exiting tasks in the v1 freezer

[Tejun Heo]

Applied to cgroup/for-7.4-fixes with v7.1+ added to the stable tag and the following tags added:

  Reviewed-by: Tao Cui <cuitao@kylinos.cn>
  Tested-by: Tao Cui <cuitao@kylinos.cn>

Thanks.

--
tejun