Re: [PATCH v3 0/7] blk-cgroup: fix races related to blkg_list iteration

[Yu Kuai]

Friendly ping ...

Hope we can consider this for 7.1-rc1 merge window.

在 2026/3/4 15:38, Yu Kuai 写道:
> This series fixes several race conditions related to q->blkg_list iteration
> and improves the locking around blkcg policy activation/deactivation.
>
> Patch 1-2: Protect q->blkg_list iteration with blkcg_mutex in blkg_destroy_all()
> and bfq_end_wr_async() to prevent races with blkg_free_workfn().
>
> Patch 3-4: Fix use-after-free and memory leak issues in blkcg_activate_policy()
> by extending blkcg_mutex coverage and skipping dying blkgs.
>
> Patch 5: Refactor policy pd teardown into a helper function.
>
> Patch 6: Restructure blkcg_activate_policy() to allocate pds before freezing
> the queue, avoiding potential deadlocks from percpu allocation. Also fix
> locking order in blkcg_deactivate_policy() to be consistent with
> blkcg_activate_policy() (mutex -> freeze).
>
> Patch 7: Move rq_qos_mutex handling inside rq_qos_add()/rq_qos_del() to
> simplify the locking and eliminate potential deadlocks.
>
> Note: queue_lock is still used in many places to protect queue blkg.
> Future work is to convert it to blkcg_mutex entirely.
>
> Changes v2 -> v3:
> - Patch 2: Wrap mutex_lock/unlock with #ifdef CONFIG_BFQ_GROUP_IOSCHED to
>    fix compile error when CONFIG_BLK_CGROUP is disabled.
> - Patch 6: Fix locking order in blkcg_deactivate_policy() to match
>    blkcg_activate_policy() (mutex -> freeze instead of freeze -> mutex).
> - Patch 7: Remove stale lockdep_assert_held() in iolatency_set_limit().
>
> Changes v1 -> v2:
> - Link: https://lore.kernel.org/all/20260108014416.3656493-1-zhengqixing@xxxxxxxxxxxxxxx/
>
> Yu Kuai (4):
>    blk-cgroup: protect q->blkg_list iteration in blkg_destroy_all() with
>      blkcg_mutex
>    bfq: protect q->blkg_list iteration in bfq_end_wr_async() with
>      blkcg_mutex
>    blk-cgroup: allocate pds before freezing queue in
>      blkcg_activate_policy()
>    blk-rq-qos: move rq_qos_mutex acquisition inside rq_qos_add/del
>
> Zheng Qixing (3):
>    blk-cgroup: fix race between policy activation and blkg destruction
>    blk-cgroup: skip dying blkg in blkcg_activate_policy()
>    blk-cgroup: factor policy pd teardown loop into helper
>
>   block/bfq-cgroup.c    |   3 +-
>   block/bfq-iosched.c   |   6 ++
>   block/blk-cgroup.c    | 205 ++++++++++++++----------------------------
>   block/blk-cgroup.h    |   2 -
>   block/blk-iocost.c    |  11 +--
>   block/blk-iolatency.c |   5 --
>   block/blk-rq-qos.c    |  31 ++++---
>   block/blk-wbt.c       |   2 -
>   8 files changed, 97 insertions(+), 168 deletions(-)
>
-- 
Thansk,
Kuai