Re: [RFC PATCH v8 1/4] blk-iocost: add BPF struct_ops cost model support

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] block: Use-After-Free in q_to_ioc() list traversal due to dropped rq_qos_mutex
--

commit 18772c6b40ac8eb626b52af0f79d379ddd873095
Author: Tao Cui <cui.tao@linux.dev>

blk-iocost: add BPF struct_ops cost model support

This commit adds BPF struct_ops support to blk-iocost, allowing a BPF
program to fully replace the builtin linear cost model for a device.
It registers the iocost_model_ops struct_ops type and binds the custom
cost model to the target device's block cgroup paths.

> diff --git a/block/blk-iocost.c b/block/blk-iocost.c
> --- a/block/blk-iocost.c
> +++ b/block/blk-iocost.c
> @@ -3584,6 +3584,204 @@ static int ioc_cost_model_show(struct seq_file *sf, void *v)
>  	return 0;
>  }
>  
> +#ifdef CONFIG_BLK_CGROUP_IOCOST_BPF

[ ... ]

> +int ioc_bpf_attach(struct iocost_model_ops *ops)
> +{
> +	struct block_device *bdev;
> +	struct request_queue *q;
> +	struct gendisk *disk;
> +	struct ioc *ioc;
> +	unsigned int memflags;
> +	int ret;

[ ... ]

> +	mutex_lock(&q->rq_qos_mutex);
> +	if (!disk_live(disk) || !blk_get_queue(q)) {
> +		mutex_unlock(&q->rq_qos_mutex);
> +		ret = -ENODEV;
> +		goto put;
> +	}
> +	ioc = q_to_ioc(q);
> +	if (!ioc) {
> +		ret = blk_iocost_init(disk);
> +		mutex_unlock(&q->rq_qos_mutex);
> +		if (ret)
> +			goto put_q;
> +		ioc = q_to_ioc(q);

[Severity: High]
Is it safe to call q_to_ioc() here after dropping rq_qos_mutex?

q_to_ioc() internally calls rq_qos_id(), which traverses the non-RCU
q->rq_qos linked list locklessly. Because the protecting rq_qos_mutex
is unlocked just prior to this call, could a concurrent thread (such as
one disabling another QoS policy via sysfs, or a device removal triggering
rq_qos_exit()) modify the list and cause a use-after-free during this
unprotected traversal?

> +	} else {
> +		mutex_unlock(&q->rq_qos_mutex);
> +	}
> +

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260930075154.189958-1-cui.tao@linux.dev?part=1