Hi, I think I found where the NULL may come from. Please, anybody, do not apply this patch before a trustful person reviewed it... Jens? ;) My thoughts on this are, that there are two possibilities cfqq->next_rq could be NULL: End of list or a bug when it is set (or not set). But why does RB_EMPTY_ROOT() as last call in this loop does not trigger? Did I even get the right place on where the NULL pointer dereference happens? :) =Hannes Signed-off-by: Johannes Weiner