Re: [PATCH 43/98] blk-mq: free the bitmaps of tags in the SRCU callback

[Hannes Reinecke <hare@suse.de>]

On 10/28/26 5:41 PM, Jens Axboe wrote:
> From: Josef Bacik <josef@toxicpanda.com>
> 
> Commit ad0d05dbddc1 keeps struct blk_mq_tags and the requests until the
> iterators under tags_srcu are gone, but the two bitmaps they walk are
> still freed right away. When the number of hardware queues shrinks,
> blk_mq_tagset_busy_iter() may be about to walk tags that
> __blk_mq_update_nr_hw_queues() frees. sbitmap_free() clears the map
> pointer, so that's a NULL dereference or a use-after-free, depending on
> the timing.
> 
> Free the bitmaps with the rest in the callback.
> 
> Fixes: ad0d05dbddc1 ("blk-mq: Defer freeing of tags page_list to SRCU callback")
> Signed-off-by: Josef Bacik <josef@toxicpanda.com>
> Signed-off-by: Jens Axboe <axboe@kernel.dk>
> ---
>   block/blk-mq-tag.c | 8 ++++----
>   1 file changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/block/blk-mq-tag.c b/block/blk-mq-tag.c
> index aaea2e2c2f23..e3edf18697af 100644
> --- a/block/blk-mq-tag.c
> +++ b/block/blk-mq-tag.c
> @@ -623,17 +623,17 @@ static void blk_mq_free_tags_callback(struct rcu_head *head)
>   		kmemleak_free(page_address(page));
>   		__free_pages(page, page->private);
>   	}
> +	/* An iterator may walk the bitmaps for as long as it may see the tags */
> +	sbitmap_queue_free(&tags->bitmap_tags);
> +	sbitmap_queue_free(&tags->breserved_tags);
>   	kfree(tags);
>   }
>   
>   void blk_mq_free_tags(struct blk_mq_tags *tags)
>   {
> -	sbitmap_queue_free(&tags->bitmap_tags);
> -	sbitmap_queue_free(&tags->breserved_tags);
> -
>   	/* if tags pages is not allocated yet, free tags directly */
>   	if (list_empty(&tags->page_list)) {
> -		kfree(tags);
> +		blk_mq_free_tags_callback(&tags->rcu_head);
>   		return;
>   	}
>   
Reviewed-by: Hannes Reinecke <hare@kernel.org>

Cheers,

Hannes
-- 
Dr. Hannes Reinecke                  Kernel Storage Architect
hare@suse.de                                +49 911 74053 688
SUSE Software Solutions GmbH, Frankenstr. 146, 90461 Nürnberg
HRB 36809 (AG Nürnberg), GF: I. Totev, A. McDonald, W. Knoblich