From 05ce1df3756773862c056ca8698f8ec4cdd7fe98 Mon Sep 17 00:00:00 2001 From: Josef Bacik Date: Wed, 28 Oct 2026 10:41:05 -0600 Subject: [PATCH] blk-iocost: free struct ioc after a grace period ioc_qos_prfill() and ioc_cost_model_prfill() take ioc->lock from blkcg_print_blkgs(), which since commit 56cc24f59c14 runs under RCU only. That covers the policy data, which is freed after a grace period, but not the ioc it points to: ioc_rqos_exit() frees that right away, and a concurrent read of io.cost.qos locks freed memory. Free the ioc with kfree_rcu_mightsleep(). Fixes: 56cc24f59c14 ("blk-cgroup: don't nest queue_lock under rcu in blkcg_print_blkgs()") Cc: Tejun Heo Signed-off-by: Josef Bacik Acked-by: Tejun Heo Link: https://patch.msgid.link/20261028164415.1262013-3-axboe@kernel.dk Signed-off-by: Jens Axboe --- block/blk-iocost.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/block/blk-iocost.c b/block/blk-iocost.c index a81488c755ca..7b5d865d8c14 100644 --- a/block/blk-iocost.c +++ b/block/blk-iocost.c @@ -2920,7 +2920,8 @@ static void ioc_rqos_exit(struct rq_qos *rqos) timer_shutdown_sync(&ioc->timer); free_percpu(ioc->pcpu_stat); - kfree(ioc); + /* blkcg_print_blkgs() gets here from a pd with only RCU held */ + kfree_rcu_mightsleep(ioc); } static const struct rq_qos_ops ioc_rqos_ops = {