memcg: take reference before releasing rcu_read_lock

/*

 * Enqueue the creation of a per-memcg kmem_cache.

 * Called with rcu_read_lock.

 */

static void __memcg_create_cache_enqueue(struct mem_cgroup *memcg,

					 struct kmem_cache *cachep)

	struct create_work *cw;

	cw = kmalloc(sizeof(struct create_work), GFP_NOWAIT);

	if (cw == NULL)

		return;

	/* The corresponding put will be done in the workqueue. */

	if (!css_tryget(&memcg->css)) {

		kfree(cw);

	if (cw == NULL) {

		css_put(&memcg->css);

		return;

	}

	rcu_read_lock();

	memcg = mem_cgroup_from_task(rcu_dereference(current->mm->owner));

	rcu_read_unlock();

	if (!memcg_can_account_kmem(memcg))

		return cachep;

		goto out;

	idx = memcg_cache_id(memcg);

	 * code updating memcg_caches will issue a write barrier to match this.

	 */

	read_barrier_depends();

	if (unlikely(cachep->memcg_params->memcg_caches[idx] == NULL)) {

	if (likely(cachep->memcg_params->memcg_caches[idx])) {

		cachep = cachep->memcg_params->memcg_caches[idx];

		goto out;

	}

	/* The corresponding put will be done in the workqueue. */

	if (!css_tryget(&memcg->css))

		goto out;

	rcu_read_unlock();

	/*

	 * If we are in a safe context (can wait, and not in interrupt

	 * context), we could be be predictable and return right away.

	 */

	memcg_create_cache_enqueue(memcg, cachep);

	return cachep;

	}

	return cachep->memcg_params->memcg_caches[idx];

out:

	rcu_read_unlock();

	return cachep;

}

EXPORT_SYMBOL(__memcg_kmem_get_cache);