1 files changed, 7 insertions, 8 deletions

diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
index fac188dd78fa..dfb8cb0af13a 100644
--- a/block/bfq-iosched.c
+++ b/block/bfq-iosched.c
@@ -2822,7 +2822,7 @@ static void bfq_dispatch_remove(struct request_queue *q, struct request *rq)
         bfq_remove_request(q, rq);
 }
 
-static void __bfq_bfqq_expire(struct bfq_data *bfqd, struct bfq_queue *bfqq)
+static bool __bfq_bfqq_expire(struct bfq_data *bfqd, struct bfq_queue *bfqq)
 {
         /*
          * If this bfqq is shared between multiple processes, check
@@ -2855,9 +2855,11 @@ static void __bfq_bfqq_expire(struct bfq_data *bfqd, struct bfq_queue *bfqq)
         /*
          * All in-service entities must have been properly deactivated
          * or requeued before executing the next function, which
-         * resets all in-service entites as no more in service.
+         * resets all in-service entities as no more in service. This
+         * may cause bfqq to be freed. If this happens, the next
+         * function returns true.
          */
-        __bfq_bfqd_reset_in_service(bfqd);
+        return __bfq_bfqd_reset_in_service(bfqd);
 }
 
 /**
@@ -3262,7 +3264,6 @@ void bfq_bfqq_expire(struct bfq_data *bfqd,
         bool slow;
         unsigned long delta = 0;
         struct bfq_entity *entity = &bfqq->entity;
-        int ref;
 
         /*
          * Check whether the process is slow (see bfq_bfqq_is_slow).
@@ -3347,10 +3348,8 @@ void bfq_bfqq_expire(struct bfq_data *bfqd,
          * reason.
          */
         __bfq_bfqq_recalc_budget(bfqd, bfqq, reason);
-        ref = bfqq->ref;
-        __bfq_bfqq_expire(bfqd, bfqq);
-
-        if (ref == 1) /* bfqq is gone, no more actions on it */
+        if (__bfq_bfqq_expire(bfqd, bfqq))
+                /* bfqq is gone, no more actions on it */
                 return;
 
         bfqq->injected_service = 0;