Commit 11f00074f72a for kernel

commit 11f00074f72a977274c64c100372764eb04e6a3f
Merge: de95ad90fb19 d8769544bde5
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Tue May 5 15:43:32 2026 -0700

    Merge tag 'cgroup-for-7.1-rc2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup

    Pull cgroup fixes from Tejun Heo:

     - During v6.19, cgroup task unlink was moved from do_exit() to after the
       final task switch to satisfy a controller invariant. That left the kernel
       seeing tasks past exit_signals() longer than userspace expected, and
       several v7.0 follow-ups tried to bridge the gap by making rmdir wait for
       the kernel side. None held up.

       The latest is an A-A deadlock when rmdir is invoked by the reaper of
       zombies whose pidns teardown the rmdir itself is waiting on, which
       points at the synchronizing approach being fundamentally wrong.

       Take a different approach: drop the wait, leave rmdir's user-visible
       side returning as soon as cgroup.procs is empty, and defer the css
       percpu_ref kill that drives ->css_offline() until the cgroup is fully
       depopulated.

       Tagged for stable. Somewhat invasive but contained. The hope is that
       fixing forward sticks. If not, the fallback is to revert the entire
       chain and rework on the development branch.

       Note that this doesn't plug a pre-existing analogous race in
       cgroup_apply_control_disable() (controller disable via
       subtree_control). Not a regression. The development branch will do
       the more invasive restructuring needed for that.

     - Documentation update for cgroup-v1 charge-commit section that still
       referenced functions removed when the memcg hugetlb try-commit-cancel
       protocol was retired.

    * tag 'cgroup-for-7.1-rc2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup:
      docs: cgroup-v1: Update charge-commit section
      cgroup: Defer css percpu_ref kill on rmdir until cgroup is depopulated