in dd_finish_request(), per_prio points to a rq->elv.priv[0], which could be
free memory if an in-flight requests completes after its associated scheduler
has been freed
Signed-off-by: Elijah Wright <git@elijahs.space>
---
block/mq-deadline.c | 16 +++++++++-------
1 file changed, 9 insertions(+), 7 deletions(-)
diff --git a/block/mq-deadline.c b/block/mq-deadline.c
index 2edf1cac06d5..4d7b21b144d3 100644
--- a/block/mq-deadline.c
+++ b/block/mq-deadline.c
@@ -751,13 +751,15 @@ static void dd_finish_request(struct request *rq)
{
struct dd_per_prio *per_prio = rq->elv.priv[0];
- /*
- * The block layer core may call dd_finish_request() without having
- * called dd_insert_requests(). Skip requests that bypassed I/O
- * scheduling. See also blk_mq_request_bypass_insert().
- */
- if (per_prio)
- atomic_inc(&per_prio->stats.completed);
+ if (rq->q->elevator) {
+ /*
+ * The block layer core may call dd_finish_request() without having
+ * called dd_insert_requests(). Skip requests that bypassed I/O
+ * scheduling. See also blk_mq_request_bypass_insert().
+ */
+ if (per_prio)
+ atomic_inc(&per_prio->stats.completed);
+ }
}
static bool dd_has_work_for_prio(struct dd_per_prio *per_prio)
--
2.43.0
