CVE-2026-90183blk-iolatency: clear delay state when freeing policy data

Official description

In the Linux kernel, the following vulnerability has been resolved: blk-iolatency: clear delay state when freeing policy data io.latency can throttle a group which has no latency target of its own. When a sibling misses its target, check_scale_change() scales down its peers, and a peer that reaches queue depth one gets blkcg_use_delay() called on it on every further scale-down, even with min_lat_nsec == 0. iolatency_pd_offline() resets the target through iolatency_set_min_lat_nsec(), which clears the delay only on a nonzero to zero transition, so it never clears such a peer. Freeing the policy data then leaves blkg->use_delay set and blkcg->congestion_count elevated with nothing left that can drop it. blk_cgroup_congested() then returns true for every task in that cgroup and its descendants for as long as the cgroup lives: page_cache_sync_ra() cuts readahead to a single page, page_cache_async_ra() skips it altogether, and __folio_throttle_swaprate() takes swap_avail_lock and schedules a throttle on anonymous folio allocation. Clear the delay in iolatency_pd_free(). By then bio-held blkg references have drained, or the queue is frozen for policy deactivation, so check_scale_change() cannot re-arm it. The free callback can also see policy data which was never attached to a blkg, hence the pd->blkg check.

Affected packages & fixed versions

Affected products (as reported)

References

• https://git.kernel.org/stable/c/27573278b1cbc2313ebd31309ac18ac6179b828a
• https://git.kernel.org/stable/c/53ccb4b967edc5f82ff6f9c066fb96c31aa7561a
• https://git.kernel.org/stable/c/b6449a915d1826e1450f6368fc379fe44caa06ca
• https://git.kernel.org/stable/c/5c6593422eb3c3a21505436ccf74599a433584c8
• https://git.kernel.org/stable/c/02f1b90ab33ef99c89dd96a385b432ff57abc64d
• https://git.kernel.org/stable/c/8935bf22c0a0db517a7f72f7097300e05dd852f5