fs2: reset cgroup.freeze to thawed when freezing fails

When freezing a cgroup v2 fails after the freeze was requested (for
example the freeze times out, or the confirmed state does not match),
setFreezer returned the error but left cgroup.freeze set to "1", leaving
the cgroup in a half-frozen state. Reset it back to "0" (thawed) on the
freeze error path via a best-effort deferred write, mirroring the cgroup
v1 behaviour from runc#2774.

Fixes opencontainers/runc#5325

Signed-off-by: Aman Raj <aman.yug@gmail.com>

Author: yugstar

fs2/freezer.go

@@ -13,7 +13,7 @@ import (
 	"github.com/opencontainers/cgroups"
 )
 
-func setFreezer(dirPath string, state cgroups.FreezerState) error {
+func setFreezer(dirPath string, state cgroups.FreezerState) (retErr error) {
 	var stateStr string
 	switch state {
 	case cgroups.Undefined:
@@ -38,6 +38,17 @@ func setFreezer(dirPath string, state cgroups.FreezerState) error {
 	}
 	defer fd.Close()
 
+	// If freezing fails (for example the freeze times out), reset the cgroup
+	// back to thawed so it is not left in a half-frozen state. This mirrors
+	// the cgroup v1 behaviour (see runc#2774).
+	if state == cgroups.Frozen {
+		defer func() {
+			if retErr != nil {
+				_ = cgroups.WriteFile(dirPath, "cgroup.freeze", "0")
+			}
+		}()
+	}
+
 	if _, err := fd.WriteString(stateStr); err != nil {
 		return err
 	}