[PATCH v2 0/7] blk-cgroup: fix races and deadlocks

From: Yu Kuai

Date: Tue Feb 03 2026 - 03:06:26 EST


Changes in v2:
- check dying blkg early in patch 4;
- add patch 7 to fix rq_qos_mutex related deadlocks;

This series fixes race conditions between blkcg_activate_policy() and
blkg destruction, and optimizes the policy activation path.

Patches 1-2 add missing blkcg_mutex protection for q->blkg_list iteration.

Patches 3-5 from Zheng Qixing fix use-after-free and memory leak issues
caused by races between policy activation and blkg destruction.

Patch 6 restructures blkcg_activate_policy() to allocate pds before
freezing the queue. This is a prep patch to fix deadlocks related to
percpu allocation with queue frozen, since some policies like iocost
and iolatency do percpu allocation in pd_alloc_fn().

Patch 7 reduces freeze queue contex by moving rq_qos_mutex into
rq_qos_add/del, so that allocate memory without queue frozen.

Yu Kuai (4):
blk-cgroup: protect q->blkg_list iteration in blkg_destroy_all() with
blkcg_mutex
bfq: protect q->blkg_list iteration in bfq_end_wr_async() with
blkcg_mutex
blk-cgroup: allocate pds before freezing queue in
blkcg_activate_policy()
blk-rq-qos: move rq_qos_mutex acquisition inside rq_qos_add/del

Zheng Qixing (3):
blk-cgroup: fix race between policy activation and blkg destruction
blk-cgroup: skip dying blkg in blkcg_activate_policy()
blk-cgroup: factor policy pd teardown loop into helper

block/bfq-cgroup.c | 3 +-
block/bfq-iosched.c | 2 +
block/blk-cgroup.c | 200 ++++++++++++++------------------------------
block/blk-cgroup.h | 2 -
block/blk-iocost.c | 11 +--
block/blk-rq-qos.c | 31 ++++---
block/blk-wbt.c | 2 -
7 files changed, 90 insertions(+), 161 deletions(-)

--
2.51.0