github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

blk-iocost: free struct ioc after a grace period

Browse Source 
ioc_qos_prfill() and ioc_cost_model_prfill() take ioc->lock from
blkcg_print_blkgs(), which since commit 56cc24f59c runs under RCU only.
That covers the policy data, which is freed after a grace period, but
not the ioc it points to: ioc_rqos_exit() frees that right away, and a
concurrent read of io.cost.qos locks freed memory.

Free the ioc with kfree_rcu_mightsleep().

Fixes: 56cc24f59c ("blk-cgroup: don't nest queue_lock under rcu in blkcg_print_blkgs()")
Cc: Tejun Heo <tj@kernel.org>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Acked-by: Tejun Heo <tj@kernel.org>
Link: https://patch.msgid.link/20261028164415.1262013-3-axboe@kernel.dk
Signed-off-by: Jens Axboe <axboe@kernel.dk>
This commit is contained in:
Josef Bacik 2026-10-28 10:41:05 -06:00 committed by Jens Axboe
parent 0e1daaf9b2
commit 05ce1df375
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
block/blk-iocost.c
View File

@ -2920,7 +2920,8 @@ static void ioc_rqos_exit(struct rq_qos *rqos)
timer_shutdown_sync(&ioc->timer);
free_percpu(ioc->pcpu_stat);
kfree(ioc);
/* blkcg_print_blkgs() gets here from a pd with only RCU held */
kfree_rcu_mightsleep(ioc);
}
static const struct rq_qos_ops ioc_rqos_ops = {