[PATCH] blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current()

[PATCH] blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current()

[Jackie Liu]

From: Jackie Liu <liuyun01@kylinos.cn>

Add the missing put_disk() on the error path in
blkcg_maybe_throttle_current(). When blkcg lookup, blkg lookup, or
blkg_tryget() fails, the function jumps to the out label which only
calls rcu_read_unlock() but does not release the disk reference acquired
by blkcg_schedule_throttle() via get_device(). Since current->throttle_disk
is already set to NULL before the lookup, blkcg_exit() cannot release
this reference either, causing the disk to never be freed.

Restore the reference release that was present as blk_put_queue() in the
original code but was inadvertently dropped during the conversion from
request_queue to gendisk.

Fixes: f05837ed73d0 ("blk-cgroup: store a gendisk to throttle in struct task_struct")
Signed-off-by: Jackie Liu <liuyun01@kylinos.cn>
---
 block/blk-cgroup.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
index b70096497d38..c377241ee13c 100644
--- a/block/blk-cgroup.c
+++ b/block/blk-cgroup.c
@@ -2022,6 +2022,7 @@ void blkcg_maybe_throttle_current(void)
 	return;
 out:
 	rcu_read_unlock();
+	put_disk(disk);
 }
 
 /**
-- 
2.51.1

Re: [PATCH] blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current()

[Christoph Hellwig]

On Tue, Mar 31, 2026 at 04:50:54PM +0800, Jackie Liu wrote:
> From: Jackie Liu <liuyun01@kylinos.cn>
> 
> Add the missing put_disk() on the error path in
> blkcg_maybe_throttle_current(). When blkcg lookup, blkg lookup, or
> blkg_tryget() fails, the function jumps to the out label which only
> calls rcu_read_unlock() but does not release the disk reference acquired
> by blkcg_schedule_throttle() via get_device(). Since current->throttle_disk
> is already set to NULL before the lookup, blkcg_exit() cannot release
> this reference either, causing the disk to never be freed.
> 
> Restore the reference release that was present as blk_put_queue() in the
> original code but was inadvertently dropped during the conversion from
> request_queue to gendisk.

Looks good:

Reviewed-by: Christoph Hellwig <hch@lst.de>

Re: [PATCH] blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current()

[Tejun Heo]

On Tue, Mar 31, 2026 at 04:50:54PM +0800, Jackie Liu wrote:
> Add the missing put_disk() on the error path in
> blkcg_maybe_throttle_current(). When blkcg lookup, blkg lookup, or
> blkg_tryget() fails, the function jumps to the out label which only
> calls rcu_read_unlock() but does not release the disk reference acquired
> by blkcg_schedule_throttle() via get_device(). Since current->throttle_disk
> is already set to NULL before the lookup, blkcg_exit() cannot release
> this reference either, causing the disk to never be freed.
> 
> Restore the reference release that was present as blk_put_queue() in the
> original code but was inadvertently dropped during the conversion from
> request_queue to gendisk.
> 
> Fixes: f05837ed73d0 ("blk-cgroup: store a gendisk to throttle in struct task_struct")
> Signed-off-by: Jackie Liu <liuyun01@kylinos.cn>

Acked-by: Tejun Heo <tj@kernel.org>

Thanks.

-- 
tejun

Re: [PATCH] blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current()

[Jens Axboe]

On Tue, 31 Mar 2026 16:50:54 +0800, Jackie Liu wrote:
> Add the missing put_disk() on the error path in
> blkcg_maybe_throttle_current(). When blkcg lookup, blkg lookup, or
> blkg_tryget() fails, the function jumps to the out label which only
> calls rcu_read_unlock() but does not release the disk reference acquired
> by blkcg_schedule_throttle() via get_device(). Since current->throttle_disk
> is already set to NULL before the lookup, blkcg_exit() cannot release
> this reference either, causing the disk to never be freed.
> 
> [...]

Applied, thanks!

[1/1] blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current()
      commit: 23308af722fefed00af5f238024c11710938fba3

Best regards,
-- 
Jens Axboe