[PATCH] blk-cgroup: use GFP_NOIO for radix tree preload in blkg_conf_prep

[PATCH] blk-cgroup: use GFP_NOIO for radix tree preload in blkg_conf_prep

[Tao Yu]

blkg_conf_prep() allocates a new blkg with GFP_NOIO after dropping
queue_lock, but still preloads the radix tree node with GFP_KERNEL while
q->blkcg_mutex is held.

GFP_KERNEL may enter direct reclaim and acquire fs_reclaim, which adds
the dependency

  q->blkcg_mutex -> fs_reclaim

This completes a circular locking dependency with the existing path

  fs_reclaim -> q->q_usage_counter -> q->blkcg_mutex

and triggers a lockdep warning when configuring blkcg policies.

Use GFP_NOIO for radix_tree_preload() so that the preload context matches
the rest of this allocation path and does not recurse into reclaim while
q->blkcg_mutex is held.

Reported-by: syzbot+144a1c0e22e53a08ef5a@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=144a1c0e22e53a08ef5a
Fixes: f255c19b3ab46 ("blk-cgroup: Pre-allocate tree node on blkg_conf_prep")
Cc: stable@vger.kernel.org
Signed-off-by: Tao Yu <tao1.yu@intel.com>
---
 block/blk-cgroup.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
index 2b5c29434e426..27e00180e4cc1 100644
--- a/block/blk-cgroup.c
+++ b/block/blk-cgroup.c
@@ -873,7 +873,7 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol,
 			parent = blkcg_parent(parent);
 		}
 
-		/* Drop locks to do new blkg allocation with GFP_KERNEL. */
+		/* Drop queue_lock to do new blkg allocation with GFP_NOIO. */
 		spin_unlock_irq(&q->queue_lock);
 
 		new_blkg = blkg_alloc(pos, disk, GFP_NOIO);
@@ -882,7 +882,7 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol,
 			goto fail_exit;
 		}
 
-		if (radix_tree_preload(GFP_KERNEL)) {
+		if (radix_tree_preload(GFP_NOIO)) {
 			blkg_free(new_blkg);
 			ret = -ENOMEM;
 			goto fail_exit;
-- 
2.34.1

Re: [PATCH] blk-cgroup: use GFP_NOIO for radix tree preload in blkg_conf_prep

[yu kuai]

Hi,

在 2026/8/31 13:57, Tao Yu 写道:
> blkg_conf_prep() allocates a new blkg with GFP_NOIO after dropping
> queue_lock, but still preloads the radix tree node with GFP_KERNEL while
> q->blkcg_mutex is held.
>
> GFP_KERNEL may enter direct reclaim and acquire fs_reclaim, which adds
> the dependency
>
>    q->blkcg_mutex -> fs_reclaim
>
> This completes a circular locking dependency with the existing path
>
>    fs_reclaim -> q->q_usage_counter -> q->blkcg_mutex
>
> and triggers a lockdep warning when configuring blkcg policies.
>
> Use GFP_NOIO for radix_tree_preload() so that the preload context matches
> the rest of this allocation path and does not recurse into reclaim while
> q->blkcg_mutex is held.
>
> Reported-by: syzbot+144a1c0e22e53a08ef5a@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=144a1c0e22e53a08ef5a
> Fixes: f255c19b3ab46 ("blk-cgroup: Pre-allocate tree node on blkg_conf_prep")
> Cc: stable@vger.kernel.org
> Signed-off-by: Tao Yu <tao1.yu@intel.com>
> ---

This problem is already fixed by following patch, the radix_tree_preload 
is removed.

[PATCH 1/3] blk-cgroup: use a request_queue rhashtable for blkg lookup - 
Yu Kuai 
<https://lore.kernel.org/all/20260823133045.970199-2-yukuai@kernel.org/>

>   block/blk-cgroup.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
> index 2b5c29434e426..27e00180e4cc1 100644
> --- a/block/blk-cgroup.c
> +++ b/block/blk-cgroup.c
> @@ -873,7 +873,7 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol,
>   			parent = blkcg_parent(parent);
>   		}
>   
> -		/* Drop locks to do new blkg allocation with GFP_KERNEL. */
> +		/* Drop queue_lock to do new blkg allocation with GFP_NOIO. */
>   		spin_unlock_irq(&q->queue_lock);
>   
>   		new_blkg = blkg_alloc(pos, disk, GFP_NOIO);
> @@ -882,7 +882,7 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol,
>   			goto fail_exit;
>   		}
>   
> -		if (radix_tree_preload(GFP_KERNEL)) {
> +		if (radix_tree_preload(GFP_NOIO)) {
>   			blkg_free(new_blkg);
>   			ret = -ENOMEM;
>   			goto fail_exit;

-- 
Thanks,
Kuai