On 6/17/25 1:56 PM, Elijah Wright wrote:
in dd_finish_request(), per_prio points to a rq->elv.priv[0], which could be free memory if an in-flight requests completes after its associated scheduler has been freed Signed-off-by: Elijah Wright <git@elijahs.space> --- block/mq-deadline.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/block/mq-deadline.c b/block/mq-deadline.c index 2edf1cac06d5..4d7b21b144d3 100644 --- a/block/mq-deadline.c +++ b/block/mq-deadline.c @@ -751,13 +751,15 @@ static void dd_finish_request(struct request *rq) { struct dd_per_prio *per_prio = rq->elv.priv[0];- /*- * The block layer core may call dd_finish_request() without having - * called dd_insert_requests(). Skip requests that bypassed I/O - * scheduling. See also blk_mq_request_bypass_insert(). - */ - if (per_prio) - atomic_inc(&per_prio->stats.completed); + if (rq->q->elevator) { + /* + * The block layer core may call dd_finish_request() without having + * called dd_insert_requests(). Skip requests that bypassed I/O + * scheduling. See also blk_mq_request_bypass_insert(). + */ + if (per_prio) + atomic_inc(&per_prio->stats.completed); + } }
The warnings in dd_exit_sched() will be triggered if dd_finish_request() is ever called with rq->q->elevator == NULL. If this can happen, it should be fixed in the block layer core instead of in the mq-deadline scheduler. Thanks, Bart.
