From 10b249e9b05eed0c4c65b9b89dfc2cf33d68d19a Mon Sep 17 00:00:00 2001 From: Josef Bacik Date: Wed, 28 Oct 2026 10:41:46 -0600 Subject: [PATCH] blk-mq: free the bitmaps of tags in the SRCU callback Commit ad0d05dbddc1 keeps struct blk_mq_tags and the requests until the iterators under tags_srcu are gone, but the two bitmaps they walk are still freed right away. When the number of hardware queues shrinks, blk_mq_tagset_busy_iter() may be about to walk tags that __blk_mq_update_nr_hw_queues() frees. sbitmap_free() clears the map pointer, so that's a NULL dereference or a use-after-free, depending on the timing. Free the bitmaps with the rest in the callback. Fixes: ad0d05dbddc1 ("blk-mq: Defer freeing of tags page_list to SRCU callback") Signed-off-by: Josef Bacik Reviewed-by: Hannes Reinecke Link: https://patch.msgid.link/20261028164415.1262013-44-axboe@kernel.dk Signed-off-by: Jens Axboe --- block/blk-mq-tag.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/block/blk-mq-tag.c b/block/blk-mq-tag.c index 2b751bfa50e1..3515031b3226 100644 --- a/block/blk-mq-tag.c +++ b/block/blk-mq-tag.c @@ -611,17 +611,17 @@ static void blk_mq_free_tags_callback(struct rcu_head *head) kmemleak_free(page_address(page)); __free_pages(page, page->private); } + /* An iterator may walk the bitmaps for as long as it may see the tags */ + sbitmap_queue_free(&tags->bitmap_tags); + sbitmap_queue_free(&tags->breserved_tags); kfree(tags); } void blk_mq_free_tags(struct blk_mq_tags *tags) { - sbitmap_queue_free(&tags->bitmap_tags); - sbitmap_queue_free(&tags->breserved_tags); - /* if tags pages is not allocated yet, free tags directly */ if (list_empty(&tags->page_list)) { - kfree(tags); + blk_mq_free_tags_callback(&tags->rcu_head); return; }