Explicitly document that css sibling/descendant linkage is protected by
cgroup_mutex or RCU. Also, document in css_next_descendant_pre() and
similar functions that is isn't necessary to hold a ref on @pos.

The following changes in this patchset rely on this clarification
for simplification in memcg iteration code.

Suggested-By: Yosry Ahmed <yosryahmed@google.com>
Signed-Off-By: Kinsey Ho <kinseyho@google.com>

---
 include/linux/cgroup-defs.h |  6 +++++-
 kernel/cgroup/cgroup.c      | 16 +++++++++-------
 2 files changed, 14 insertions(+), 8 deletions(-)

diff --git a/include/linux/cgroup-defs.h b/include/linux/cgroup-defs.h
index 7fc2d0195f56..6862243bd1c2 100644
--- a/include/linux/cgroup-defs.h
+++ b/include/linux/cgroup-defs.h
@@ -172,7 +172,11 @@ struct cgroup_subsys_state {
 	/* reference count - access via css_[try]get() and css_put() */
 	struct percpu_ref refcnt;
 
-	/* siblings list anchored at the parent's ->children */
+	/*
+	 * siblings list anchored at the parent's ->children
+	 *
+	 * linkage is protected by cgroup_mutex or RCU
+	 */
 	struct list_head sibling;
 	struct list_head children;
 
diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
index 0a97cb2ef124..ece2316e2bca 100644
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -4602,8 +4602,9 @@ struct cgroup_subsys_state *css_next_child(struct cgroup_subsys_state *pos,
  *
  * While this function requires cgroup_mutex or RCU read locking, it
  * doesn't require the whole traversal to be contained in a single critical
- * section.  This function will return the correct next descendant as long
- * as both @pos and @root are accessible and @pos is a descendant of @root.
+ * section. Additionally, it isn't necessary to hold onto a reference to @pos.
+ * This function will return the correct next descendant as long as both @pos
+ * and @root are accessible and @pos is a descendant of @root.
  *
  * If a subsystem synchronizes ->css_online() and the start of iteration, a
  * css which finished ->css_online() is guaranteed to be visible in the
@@ -4651,8 +4652,9 @@ EXPORT_SYMBOL_GPL(css_next_descendant_pre);
  *
  * While this function requires cgroup_mutex or RCU read locking, it
  * doesn't require the whole traversal to be contained in a single critical
- * section.  This function will return the correct rightmost descendant as
- * long as @pos is accessible.
+ * section. Additionally, it isn't necessary to hold onto a reference to @pos.
+ * This function will return the correct rightmost descendant as long as @pos
+ * is accessible.
  */
 struct cgroup_subsys_state *
 css_rightmost_descendant(struct cgroup_subsys_state *pos)
@@ -4696,9 +4698,9 @@ css_leftmost_descendant(struct cgroup_subsys_state *pos)
  *
  * While this function requires cgroup_mutex or RCU read locking, it
  * doesn't require the whole traversal to be contained in a single critical
- * section.  This function will return the correct next descendant as long
- * as both @pos and @cgroup are accessible and @pos is a descendant of
- * @cgroup.
+ * section. Additionally, it isn't necessary to hold onto a reference to @pos.
+ * This function will return the correct next descendant as long as both @pos
+ * and @cgroup are accessible and @pos is a descendant of @cgroup.
  *
  * If a subsystem synchronizes ->css_online() and the start of iteration, a
  * css which finished ->css_online() is guaranteed to be visible in the
-- 
2.46.0.76.ge559c4bf1a-goog

On Tue, Aug 13, 2024 at 08:47:11PM GMT, Kinsey Ho <kinseyho@google.com> wrote:
> --- a/include/linux/cgroup-defs.h
> +++ b/include/linux/cgroup-defs.h
> @@ -172,7 +172,11 @@ struct cgroup_subsys_state {
>  	/* reference count - access via css_[try]get() and css_put() */
>  	struct percpu_ref refcnt;
>  
> -	/* siblings list anchored at the parent's ->children */
> +	/*
> +	 * siblings list anchored at the parent's ->children
> +	 *
> +	 * linkage is protected by cgroup_mutex or RCU
> +	 */
>  	struct list_head sibling;
>  	struct list_head children;

Thanks, this is good.

>  
> diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
> index 0a97cb2ef124..ece2316e2bca 100644
> --- a/kernel/cgroup/cgroup.c
> +++ b/kernel/cgroup/cgroup.c
> @@ -4602,8 +4602,9 @@ struct cgroup_subsys_state *css_next_child(struct cgroup_subsys_state *pos,
>   *
>   * While this function requires cgroup_mutex or RCU read locking, it
>   * doesn't require the whole traversal to be contained in a single critical
> - * section.  This function will return the correct next descendant as long
> - * as both @pos and @root are accessible and @pos is a descendant of @root.
> + * section. Additionally, it isn't necessary to hold onto a reference to @pos.
> + * This function will return the correct next descendant as long as both @pos
> + * and @root are accessible and @pos is a descendant of @root.
>   *
>   * If a subsystem synchronizes ->css_online() and the start of iteration, a
>   * css which finished ->css_online() is guaranteed to be visible in the
> @@ -4651,8 +4652,9 @@ EXPORT_SYMBOL_GPL(css_next_descendant_pre);
>   *
>   * While this function requires cgroup_mutex or RCU read locking, it
>   * doesn't require the whole traversal to be contained in a single critical
> - * section.  This function will return the correct rightmost descendant as
> - * long as @pos is accessible.
> + * section. Additionally, it isn't necessary to hold onto a reference to @pos.
> + * This function will return the correct rightmost descendant as long as @pos
> + * is accessible.
>   */
>  struct cgroup_subsys_state *
>  css_rightmost_descendant(struct cgroup_subsys_state *pos)
> @@ -4696,9 +4698,9 @@ css_leftmost_descendant(struct cgroup_subsys_state *pos)
>   *
>   * While this function requires cgroup_mutex or RCU read locking, it
>   * doesn't require the whole traversal to be contained in a single critical
> - * section.  This function will return the correct next descendant as long
> - * as both @pos and @cgroup are accessible and @pos is a descendant of
> - * @cgroup.
> + * section. Additionally, it isn't necessary to hold onto a reference to @pos.
> + * This function will return the correct next descendant as long as both @pos
> + * and @cgroup are accessible and @pos is a descendant of @cgroup.
>   *
>   * If a subsystem synchronizes ->css_online() and the start of iteration, a
>   * css which finished ->css_online() is guaranteed to be visible in the

I'd say these comments are unnecessary given the functions have
cgroup_assert_mutex_or_rcu_locked() but if it helps overall
understanding in broader context, why not.

Reviewed-by: Michal Koutný <mkoutny@suse.com>