The existing freezer propagation logic improperly reduces
nr_frozen_descendants by an increasing 'desc' counter during unfreeze,
leading to:
- Premature parent cgroup unfreezing
- Negative descendant counts
- Broken hierarchy state consistency

Scenario demonstrating the bug:
1. Create hierarchy A->B->C
2. Freeze C (A/B freeze via propagation)
3. Freeze A->D (separate branch)
4. Unfreeze C -> A incorrectly unfreezes despite frozen D

Fixes: 711f763 ("freezer,cgroup: add freezer.stats subsystem")
Signed-off-by: Umar cynexium@gmail.com
---
 kernel/cgroup/freezer.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/kernel/cgroup/freezer.c b/kernel/cgroup/freezer.c
index e9c15fbe5d9b..d384df2f53c2 100644
--- a/kernel/cgroup/freezer.c
+++ b/kernel/cgroup/freezer.c
@@ -304,6 +304,7 @@ void cgroup_freeze(struct cgroup *cgrp, bool freeze)
 			 */
 			if (dsct->freezer.e_freeze > 0)
 				continue;
+			
 			WARN_ON_ONCE(dsct->freezer.e_freeze < 0);
 		}
 
-- 
2.47.1

Umar Pathan <cynexium@gmail.com> writes:

> The existing freezer propagation logic improperly reduces
> nr_frozen_descendants by an increasing 'desc' counter during unfreeze,
> leading to:
> - Premature parent cgroup unfreezing
> - Negative descendant counts
> - Broken hierarchy state consistency
>
> Scenario demonstrating the bug:
> 1. Create hierarchy A->B->C
> 2. Freeze C (A/B freeze via propagation)
> 3. Freeze A->D (separate branch)
> 4. Unfreeze C -> A incorrectly unfreezes despite frozen D
>
> Fixes: 711f763 ("freezer,cgroup: add freezer.stats subsystem")
> Signed-off-by: Umar cynexium@gmail.com
> ---
>  kernel/cgroup/freezer.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/kernel/cgroup/freezer.c b/kernel/cgroup/freezer.c
> index e9c15fbe5d9b..d384df2f53c2 100644
> --- a/kernel/cgroup/freezer.c
> +++ b/kernel/cgroup/freezer.c
> @@ -304,6 +304,7 @@ void cgroup_freeze(struct cgroup *cgrp, bool freeze)
>  			 */
>  			if (dsct->freezer.e_freeze > 0)
>  				continue;
> +
>  			WARN_ON_ONCE(dsct->freezer.e_freeze < 0);
>  		}

Hey Umar,

I dug around Github and I think I found the patch you intended to submit
https://github.com/raspberrypi/linux/pull/6632/commits/711f76376ae7e11f48a1c22a4a04828a24d6a87a

Unfortunately, your email only contains the inverse of your PR's
whitespace change removing a line in freezer.c, not the rest of the
patch. Did you perhaps revert that whitespace change in a new commit and
accidentally only submit that commit instead of the whole change?

Thanks,
David Reaver

Hello both.

On Sat, Feb 01, 2025 at 06:08:55AM -0800, David Reaver <me@davidreaver.com> wrote:
> I dug around Github and I think I found the patch you intended to submit
> https://github.com/raspberrypi/linux/pull/6632/commits/711f76376ae7e11f48a1c22a4a04828a24d6a87a

Heh, thanks.

> Unfortunately, your email only contains the inverse of your PR's
> whitespace change removing a line in freezer.c, not the rest of the
> patch. Did you perhaps revert that whitespace change in a new commit and
> accidentally only submit that commit instead of the whole change?

There was little freezing counting rework in v6.13. If you can still
reproduce the issue, it'd be something to look into. (I'm not sure about
interpretation of the direct/propagate freezing in the reproduction
steps, if there were sample commands, it'd be nice.)

Thanks,
Michal