Thanks for the traces. So in all the cases it seems that struct bfq_group got freed while still being fully linked into various structures. The freeing always happened from blkg_free() called from RCU callback so everything points to the fact that blkg refcount got somehow corrupted (likely someone dropping a ref without taking it). Looking more into this...