[PATCH] block, bfq: skip dispatch when selected queue has no next_rq

[PATCH] block, bfq: skip dispatch when selected queue has no next_rq

[dayou5941]

From: liyouhong <liyouhong@kylinos.cn>

bfq_dispatch_rq_from_bfqq() dispatches bfqq->next_rq directly. Add a
guard in __bfq_dispatch_request() so that dispatch is skipped if the
selected queue unexpectedly has no next request.

This keeps behavior unchanged in normal paths while avoiding entering
the dispatch helper with a missing next_rq.

Signed-off-by: liyouhong <liyouhong@kylinos.cn>

diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
index 141c602d5e85..c3d9d02064b7 100644
--- a/block/bfq-iosched.c
+++ b/block/bfq-iosched.c
@@ -5226,7 +5226,7 @@ static struct request *__bfq_dispatch_request(struct blk_mq_hw_ctx *hctx)
 		goto exit;
 
 	bfqq = bfq_select_queue(bfqd);
-	if (!bfqq)
+	if (!bfqq || !bfqq->next_rq)
 		goto exit;
 
 	rq = bfq_dispatch_rq_from_bfqq(bfqd, bfqq);
-- 
2.25.1

Re: [PATCH] block, bfq: skip dispatch when selected queue has no next_rq

[Yu Kuai]

Hi,

在 2026/5/20 17:50, dayou5941@163.com 写道:
> From: liyouhong <liyouhong@kylinos.cn>
>
> bfq_dispatch_rq_from_bfqq() dispatches bfqq->next_rq directly. Add a
> guard in __bfq_dispatch_request() so that dispatch is skipped if the
> selected queue unexpectedly has no next request.
>
> This keeps behavior unchanged in normal paths while avoiding entering
> the dispatch helper with a missing next_rq.

Can you explan in which case bfqq can be returned from bfq_select_queue
with next_rq set to NULL? I didn't find it with a quick review.

Take a look at bfq_dispatch_rq_from_bfqq(), bfqq->next_rq will be dereferenced
unconditionally, which should lead to kernel crash before this patch if
next_rq can be NULL.

>
> Signed-off-by: liyouhong <liyouhong@kylinos.cn>
>
> diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
> index 141c602d5e85..c3d9d02064b7 100644
> --- a/block/bfq-iosched.c
> +++ b/block/bfq-iosched.c
> @@ -5226,7 +5226,7 @@ static struct request *__bfq_dispatch_request(struct blk_mq_hw_ctx *hctx)
>   		goto exit;
>   
>   	bfqq = bfq_select_queue(bfqd);
> -	if (!bfqq)
> +	if (!bfqq || !bfqq->next_rq)
>   		goto exit;
>   
>   	rq = bfq_dispatch_rq_from_bfqq(bfqd, bfqq);

-- 
Thansk,
Kuai

Re:Re: [PATCH] block, bfq: skip dispatch when selected queue has no next_rq

[李佑鸿]

At 2026-05-21 17:27:28, "Yu Kuai" <yukuai@fnnas.com> wrote:
>Hi,
>
>在 2026/5/20 17:50, dayou5941@163.com 写道:
>> From: liyouhong <liyouhong@kylinos.cn>
>>
>> bfq_dispatch_rq_from_bfqq() dispatches bfqq->next_rq directly. Add a
>> guard in __bfq_dispatch_request() so that dispatch is skipped if the
>> selected queue unexpectedly has no next request.
>>
>> This keeps behavior unchanged in normal paths while avoiding entering
>> the dispatch helper with a missing next_rq.
>
>Can you explan in which case bfqq can be returned from bfq_select_queue
>with next_rq set to NULL? I didn't find it with a quick review.
>
>Take a look at bfq_dispatch_rq_from_bfqq(), bfqq->next_rq will be dereferenced
>unconditionally, which should lead to kernel crash before this patch if
>next_rq can be NULL.

>

Thanks for the clarification.

I agree there is no demonstrated path for `next_rq == NULL` here, so I'll drop
this patch.

One follow-up question: if `next_rq` is guaranteed non-NULL after
`bfq_select_queue()`, would you consider the `if (rq)` check after
`bfq_dispatch_rq_from_bfqq()` redundant for that path?

Thanks,
liyouhong