I'm investigating a NULL deref crash in bfq_add_bfqq_busy(), wherein bfqq->woken_list_node is hashed, but bfqq->waker_bfqq is NULL - which seems inconsistent per my reading of the code. Wherein I see bfq_allow_bio_merge() both accesses and modifies accesses bfqd->bio_bfqq without bfqd->lock, which strikes me as odd. The call there though to bfq_setup_cooperator and bfq_merge_bfqqs() seem wrong to me. In particular, the call to bfq_merge_bfqqs() I am suspecting can cause the inconsistency seen above, since it's the only place I've found that modifies bfqq->waker_bfqq without bfqd->lock. But I'm curious in general - what's special about bio_bfqq? Should we grab bfqd->lock when touching it? e.g. bfq_request_merge() also accesses bio_bfqq without grabbing the lock, where-in we traverse bfqq->sort_list - that strikes me as odd as well, but I'm not fully familiar with the locking conventions here. But it feels like, especially since we can merge bfqqs, so bio_bfqq is shared - this lockless access seems wrong.
