[PATCH v2 0/2] blk/nvme: fix NULL deref in rq_qos_done_bio() on multipath failover

Chaitanya Kulkarni
2026-02-26T03:13:14Z

Hi,

When a bio is processed on a path's request queue with rq_qos enabled,
it gets BIO_QOS_THROTTLED or BIO_QOS_MERGED flags set. During NVMe
multipath failover, nvme_failover_req() redirects the bio's bi_bdev to
the multipath head's disk via bio_set_dev(), but the BIO_QOS flags are
left intact.

This series moves bio queue transition code into blk_steal_bios()
and adds a patch to clears BIO_QOS_THROTTLED and BIO_QOS_MERGED flags
in blk_steal_bios().

-ck

v1->v2 https://lore.kernel.org/all/20251124070142.GA17632@lst.de/:

* Add a new patch to move the bio flag fixup loop from nvme_failover_req()
into blk_steal_bios() rather than adding it only in the NVMe multipath
path. (Christoph)

Chaitanya Kulkarni (2):
block: move bio queue-transition flag fixups into blk_steal_bios()
block: clear BIO_QOS flags in blk_steal_bios()

block/blk-mq.c | 19 +++++++++++++++++++
drivers/nvme/host/multipath.c | 15 +--------------
2 files changed, 20 insertions(+), 14 deletions(-)

--
2.39.5