summaryrefslogtreecommitdiffstats
path: root/block/blk-throttle.c
diff options
context:
space:
mode:
authorJoseph Qi <qijiang.qj@alibaba-inc.com>2017-06-07 11:36:14 +0800
committerJens Axboe <axboe@fb.com>2017-06-07 08:11:24 -0600
commita41b816c174409417d91b4ceef0145c9f0bef67c (patch)
tree82b3b4311eb770dfd22e25fb9e67cff08d885c4f /block/blk-throttle.c
parent9bd2bbc01d17ddd567cc0f81f77fe1163e497462 (diff)
downloadlinux-a41b816c174409417d91b4ceef0145c9f0bef67c.tar.gz
linux-a41b816c174409417d91b4ceef0145c9f0bef67c.tar.bz2
linux-a41b816c174409417d91b4ceef0145c9f0bef67c.zip
blk-throttle: fix NULL pointer dereference in throtl_schedule_pending_timer
I have encountered a NULL pointer dereference in throtl_schedule_pending_timer: [ 413.735396] BUG: unable to handle kernel NULL pointer dereference at 0000000000000038 [ 413.735535] IP: [<ffffffff812ebbbf>] throtl_schedule_pending_timer+0x3f/0x210 [ 413.735643] PGD 22c8cf067 PUD 22cb34067 PMD 0 [ 413.735713] Oops: 0000 [#1] SMP ...... This is caused by the following case: blk_throtl_bio throtl_schedule_next_dispatch <= sq is top level one without parent throtl_schedule_pending_timer sq_to_tg(sq)->td->throtl_slice <= sq_to_tg(sq) returns NULL Fix it by using sq_to_td instead of sq_to_tg(sq)->td, which will always return a valid td. Fixes: 297e3d854784 ("blk-throttle: make throtl_slice tunable") Signed-off-by: Joseph Qi <qijiang.qj@alibaba-inc.com> Reviewed-by: Shaohua Li <shli@fb.com> Signed-off-by: Jens Axboe <axboe@fb.com>
Diffstat (limited to 'block/blk-throttle.c')
-rw-r--r--block/blk-throttle.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/block/blk-throttle.c b/block/blk-throttle.c
index fc13dd0c6e39..3b751f706c61 100644
--- a/block/blk-throttle.c
+++ b/block/blk-throttle.c
@@ -698,7 +698,7 @@ static void throtl_dequeue_tg(struct throtl_grp *tg)
static void throtl_schedule_pending_timer(struct throtl_service_queue *sq,
unsigned long expires)
{
- unsigned long max_expire = jiffies + 8 * sq_to_tg(sq)->td->throtl_slice;
+ unsigned long max_expire = jiffies + 8 * sq_to_td(sq)->throtl_slice;
/*
* Since we are adjusting the throttle limit dynamically, the sleep