deadline_*_next_rq_show() dereferences q->elevator->elevator_data without
holding elevator_lock.  Concurrent elevator switch to "none" clears
q->elevator under that lock and tears down the scheduler, so readers
crash with a null-ptr-deref.

Hold elevator_lock around the show path and bail out if the elevator has
already been removed, matching other blk-mq debugfs readers that look at
elevator state.

Reproduced on linux-next with KASAN by reading write1_next_rq via debugfs
while switching the elevator from mq-deadline to none under fio load:

 BUG: KASAN: null-ptr-deref in deadline_write1_next_rq_show+0x3c/0xf0
 Read of size 8 at addr 0000000000000010 by task cat/140857
 Call trace:
  deadline_write1_next_rq_show+0x3c/0xf0
  blk_mq_debugfs_show+0x58/0x78
  seq_read_iter+0x254/0x6f8
  seq_read+0x1a0/0x220
  vfs_read+0x14c/0x528

Signed-off-by: Xixin Liu <liuxixin@kylinos.cn>
---
 block/mq-deadline.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/block/mq-deadline.c b/block/mq-deadline.c
index 824bfc17b2c6..e7c4a91b2d08 100644
--- a/block/mq-deadline.c
+++ b/block/mq-deadline.c
@@ -842,14 +842,22 @@ static int deadline_##name##_next_rq_show(void *data,			\
 					  struct seq_file *m)		\
 {									\
 	struct request_queue *q = data;					\
-	struct deadline_data *dd = q->elevator->elevator_data;		\
-	struct dd_per_prio *per_prio = &dd->per_prio[prio];		\
+	struct elevator_queue *e;					\
+	struct deadline_data *dd;					\
+	struct dd_per_prio *per_prio;					\
 	struct request *rq;						\
+	int ret;							\
 									\
+	ret = mutex_lock_interruptible(&q->elevator_lock);		\
+	if (ret)							\
+		return ret;						\
+	e = q->elevator;						\
+	if (!e)								\
+		goto unlock;						\
+	dd = e->elevator_data;						\
+	per_prio = &dd->per_prio[prio];					\
 	rq = deadline_from_pos(per_prio, data_dir,			\
 			       per_prio->latest_pos[data_dir]);		\
 	if (rq)								\
 		__blk_mq_debugfs_rq_show(m, rq);			\
+unlock:									\
+	mutex_unlock(&q->elevator_lock);				\
 	return 0;							\
 }
 
-- 
2.43.0

On 7/20/26 11:30 PM, Xixin Liu wrote:
> diff --git a/block/mq-deadline.c b/block/mq-deadline.c
> index 824bfc17b2c6..e7c4a91b2d08 100644
> --- a/block/mq-deadline.c
> +++ b/block/mq-deadline.c
> @@ -842,14 +842,22 @@ static int deadline_##name##_next_rq_show(void *data,			\
>   					  struct seq_file *m)		\
>   {									\
>   	struct request_queue *q = data;					\
> -	struct deadline_data *dd = q->elevator->elevator_data;		\
> -	struct dd_per_prio *per_prio = &dd->per_prio[prio];		\
> +	struct elevator_queue *e;					\
> +	struct deadline_data *dd;					\
> +	struct dd_per_prio *per_prio;					\
>   	struct request *rq;						\
> +	int ret;							\
>   									\
> +	ret = mutex_lock_interruptible(&q->elevator_lock);		\
> +	if (ret)							\
> +		return ret;						\
> +	e = q->elevator;						\
> +	if (!e)								\
> +		goto unlock;						\
> +	dd = e->elevator_data;						\
> +	per_prio = &dd->per_prio[prio];					\
>   	rq = deadline_from_pos(per_prio, data_dir,			\
>   			       per_prio->latest_pos[data_dir]);		\
>   	if (rq)								\
>   		__blk_mq_debugfs_rq_show(m, rq);			\
> +unlock:									\
> +	mutex_unlock(&q->elevator_lock);				\
>   	return 0;							\
>   }
>   

The above patch uses the wrong lock and brings way too much code under
the lock. Please help with testing this patch:

diff --git a/block/mq-deadline.c b/block/mq-deadline.c
index 6e8f87e07eb9..c52601c1fa13 100644
--- a/block/mq-deadline.c
+++ b/block/mq-deadline.c
@@ -850,6 +850,7 @@ static int deadline_##name##_next_rq_show(void 
*data,			\
  	struct dd_per_prio *per_prio = &dd->per_prio[prio];		\
  	struct request *rq;						\
  									\
+	guard(spinlock)(&dd->lock);					\
  	rq = deadline_from_pos(per_prio, data_dir,			\
  			       per_prio->latest_pos[data_dir]);		\
  	if (rq)								\