From 424b9d92e35197303e568131ab8a878b9ca24f67 Mon Sep 17 00:00:00 2001 From: Aman Raj Date: Fri, 19 Jun 2026 01:04:31 +0530 Subject: [PATCH] fs2: reset cgroup.freeze to thawed when freezing fails When freezing a cgroup v2 fails after the freeze was requested (for example the freeze times out, or the confirmed state does not match), setFreezer returned the error but left cgroup.freeze set to "1", leaving the cgroup in a half-frozen state. Reset it back to "0" (thawed) on the freeze error path via a best-effort deferred write, mirroring the cgroup v1 behaviour from runc#2774. Fixes opencontainers/runc#5325 Signed-off-by: Aman Raj --- fs2/freezer.go | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/fs2/freezer.go b/fs2/freezer.go index 6307e68..2621c3c 100644 --- a/fs2/freezer.go +++ b/fs2/freezer.go @@ -13,7 +13,7 @@ import ( "github.com/opencontainers/cgroups" ) -func setFreezer(dirPath string, state cgroups.FreezerState) error { +func setFreezer(dirPath string, state cgroups.FreezerState) (retErr error) { var stateStr string switch state { case cgroups.Undefined: @@ -38,6 +38,17 @@ func setFreezer(dirPath string, state cgroups.FreezerState) error { } defer fd.Close() + // If freezing fails (for example the freeze times out), reset the cgroup + // back to thawed so it is not left in a half-frozen state. This mirrors + // the cgroup v1 behaviour (see runc#2774). + if state == cgroups.Frozen { + defer func() { + if retErr != nil { + _ = cgroups.WriteFile(dirPath, "cgroup.freeze", "0") + } + }() + } + if _, err := fd.WriteString(stateStr); err != nil { return err }