static bool blkcg_policy_enabled(struct request_queue *q,
				 const struct blkcg_policy *pol)
{
	return pol && test_bit(pol->plid, q->blkcg_pols);
}

The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.