4 files changed, 20 insertions, 3 deletions

diff --git a/block/Kconfig b/block/Kconfig
index 09acf1b39905..a7e40a7c8214 100644
--- a/block/Kconfig
+++ b/block/Kconfig
@@ -89,7 +89,7 @@ config BLK_DEV_INTEGRITY
 
 config BLK_DEV_THROTTLING
         bool "Block layer bio throttling support"
-        depends on BLK_CGROUP=y && EXPERIMENTAL
+        depends on BLK_CGROUP=y
         default n
         ---help---
         Block layer bio throttling support. It can be used to limit
diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
index cafcd7431189..d0b770391ad4 100644
--- a/block/blk-cgroup.c
+++ b/block/blk-cgroup.c
@@ -285,6 +285,13 @@ static void blkg_destroy_all(struct request_queue *q)
                 blkg_destroy(blkg);
                 spin_unlock(&blkcg->lock);
         }
+
+        /*
+         * root blkg is destroyed.  Just clear the pointer since
+         * root_rl does not take reference on root blkg.
+         */
+        q->root_blkg = NULL;
+        q->root_rl.blkg = NULL;
 }
 
 static void blkg_rcu_free(struct rcu_head *rcu_head)
@@ -326,6 +333,9 @@ struct request_list *__blk_queue_next_rl(struct request_list *rl,
          */
         if (rl == &q->root_rl) {
                 ent = &q->blkg_list;
+                /* There are no more block groups, hence no request lists */
+                if (list_empty(ent))
+                        return NULL;
         } else {
                 blkg = container_of(rl, struct blkcg_gq, rl);
                 ent = &blkg->q_node;
diff --git a/block/blk-core.c b/block/blk-core.c
index a33870b1847b..3c95c4d6e31a 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -2868,7 +2868,8 @@ static int plug_rq_cmp(void *priv, struct list_head *a, struct list_head *b)
         struct request *rqa = container_of(a, struct request, queuelist);
         struct request *rqb = container_of(b, struct request, queuelist);
 
-        return !(rqa->q <= rqb->q);
+        return !(rqa->q < rqb->q ||
+                (rqa->q == rqb->q && blk_rq_pos(rqa) < blk_rq_pos(rqb)));
 }
 
 /*
diff --git a/block/blk-exec.c b/block/blk-exec.c
index 8b6dc5bd4dd0..f71eac35c1b9 100644
--- a/block/blk-exec.c
+++ b/block/blk-exec.c
@@ -52,11 +52,17 @@ void blk_execute_rq_nowait(struct request_queue *q, struct gendisk *bd_disk,
                            rq_end_io_fn *done)
 {
         int where = at_head ? ELEVATOR_INSERT_FRONT : ELEVATOR_INSERT_BACK;
+        bool is_pm_resume;
 
         WARN_ON(irqs_disabled());
 
         rq->rq_disk = bd_disk;
         rq->end_io = done;
+        /*
+         * need to check this before __blk_run_queue(), because rq can
+         * be freed before that returns.
+         */
+        is_pm_resume = rq->cmd_type == REQ_TYPE_PM_RESUME;
 
         spin_lock_irq(q->queue_lock);
 
@@ -71,7 +77,7 @@ void blk_execute_rq_nowait(struct request_queue *q, struct gendisk *bd_disk,
         __elv_add_request(q, rq, where);
         __blk_run_queue(q);
         /* the queue is stopped so it won't be run */
-        if (rq->cmd_type == REQ_TYPE_PM_RESUME)
+        if (is_pm_resume)
                 q->request_fn(q);
         spin_unlock_irq(q->queue_lock);
 }