The kernel often crashes in cgroup_rstat_flush_locked() upon dereferencing an already-freed memcg's ->css.cgroup->rstat_cpu

Issue

• The kernel often crashes in cgroup_rstat_flush_locked() upon dereferencing an already-freed memcg's ->css.cgroup->rstat_cpu.

[2230709.998299] BUG: unable to handle kernel paging request at 000002e800001384
[2230709.999358] PGD 0 P4D 0 
[2230710.000012] Oops: 0000 [#1] SMP NOPTI
[2230710.000451] CPU: 12 PID: 869946 Comm: kworker/12:3 Kdump: loaded Tainted: P          I E    --------- -  - 4.18.0-425.3.1.el8.x86_64 #1
[2230710.000873] Hardware name: Dell Inc. PowerEdge R640/0H28RR, BIOS 2.13.3 12/13/2021
[2230710.001142] Workqueue: events percpu_stats_free_rwork_fn
[2230710.001408] RIP: 0010:cgroup_rstat_flush_locked+0x7d/0x280
[2230710.001668] Code: c8 7a 96 4c 89 f7 4c 89 74 24 08 e8 3d 39 83 00 48 8b 04 24 48 89 c1 48 85 c0 0f 84 91 01 00 00 4b 8b 74 e5 00 eb 03 4c 89 f1 <48> 8b 81 78 03 00 00 48 01 f0 4c 8b 70 30 4c 39 f1 75 ea 4c 8b 48
[2230710.002203] RSP: 0018:ffffaffa8c35fe20 EFLAGS: 00010006
[2230710.002467] RAX: 000002e80000100c RBX: 00000000ffffffff RCX: 000002e80000100c
[2230710.002730] RDX: 0000000000000001 RSI: ffff8f3078000000 RDI: ffff8f307801d6a4
[2230710.002991] RBP: 0000000000000000 R08: 0000000000000000 R09: 000073746e657665
[2230710.003249] R10: 8080808080808080 R11: 0000000000000000 R12: 0000000000000000
[2230710.003508] R13: ffffffff967ac840 R14: ffff8f307801d6a4 R15: ffff8f2fe14ee588
[2230710.003765] FS:  0000000000000000(0000) GS:ffff8f3078180000(0000) knlGS:0000000000000000
[2230710.004020] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[2230710.004320] CR2: 000002e800001384 CR3: 000000035e410003 CR4: 00000000007706e0
[2230710.004583] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[2230710.004921] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[2230710.005275] PKRU: 55555554
[2230710.005611] Call Trace:
[2230710.005947]  percpu_stats_free_rwork_fn+0x2f/0x130
[2230710.006289]  process_one_work+0x1a7/0x360
[2230710.006575]  ? create_worker+0x1a0/0x1a0
[2230710.006851]  worker_thread+0x30/0x390
[2230710.007124]  ? create_worker+0x1a0/0x1a0
[2230710.007396]  kthread+0x10b/0x130
[2230710.007662]  ? set_kthread_struct+0x50/0x50
[2230710.007927]  ret_from_fork+0x1f/0x40
[2230710.008196] Modules linked in: [...]
[2230710.010600] CR2: 000002e800001384