[PATCH v3 0/7] blk-cgroup: fix races related to blkg_list iteration

[Yu Kuai]

This series fixes several race conditions related to q->blkg_list iteration
and improves the locking around blkcg policy activation/deactivation.

Patch 1-2: Protect q->blkg_list iteration with blkcg_mutex in blkg_destroy_all()
and bfq_end_wr_async() to prevent races with blkg_free_workfn().

Patch 3-4: Fix use-after-free and memory leak issues in blkcg_activate_policy()
by extending blkcg_mutex coverage and skipping dying blkgs.

Patch 5: Refactor policy pd teardown into a helper function.

Patch 6: Restructure blkcg_activate_policy() to allocate pds before freezing
the queue, avoiding potential deadlocks from percpu allocation. Also fix
locking order in blkcg_deactivate_policy() to be consistent with
blkcg_activate_policy() (mutex -> freeze).

Patch 7: Move rq_qos_mutex handling inside rq_qos_add()/rq_qos_del() to
simplify the locking and eliminate potential deadlocks.

Note: queue_lock is still used in many places to protect queue blkg.
Future work is to convert it to blkcg_mutex entirely.

Changes v2 -> v3:
- Patch 2: Wrap mutex_lock/unlock with #ifdef CONFIG_BFQ_GROUP_IOSCHED to
  fix compile error when CONFIG_BLK_CGROUP is disabled.
- Patch 6: Fix locking order in blkcg_deactivate_policy() to match
  blkcg_activate_policy() (mutex -> freeze instead of freeze -> mutex).
- Patch 7: Remove stale lockdep_assert_held() in iolatency_set_limit().

Changes v1 -> v2:
- Link: https://lore.kernel.org/all/20260108014416.3656493-1-zhengqixing@xxxxxxxxxxxxxxx/

Yu Kuai (4):
  blk-cgroup: protect q->blkg_list iteration in blkg_destroy_all() with
    blkcg_mutex
  bfq: protect q->blkg_list iteration in bfq_end_wr_async() with
    blkcg_mutex
  blk-cgroup: allocate pds before freezing queue in
    blkcg_activate_policy()
  blk-rq-qos: move rq_qos_mutex acquisition inside rq_qos_add/del

Zheng Qixing (3):
  blk-cgroup: fix race between policy activation and blkg destruction
  blk-cgroup: skip dying blkg in blkcg_activate_policy()
  blk-cgroup: factor policy pd teardown loop into helper

 block/bfq-cgroup.c    |   3 +-
 block/bfq-iosched.c   |   6 ++
 block/blk-cgroup.c    | 205 ++++++++++++++----------------------------
 block/blk-cgroup.h    |   2 -
 block/blk-iocost.c    |  11 +--
 block/blk-iolatency.c |   5 --
 block/blk-rq-qos.c    |  31 ++++---
 block/blk-wbt.c       |   2 -
 8 files changed, 97 insertions(+), 168 deletions(-)

-- 
2.51.0