Re: [bug report] block: avoid use-after-free on throttle data

[Dan Carpenter <dan.carpenter@oracle.com>]

On Tue, Mar 22, 2022 at 03:42:28PM +0800, Ming Lei wrote:
> >   1187		if (parent_sq) {
> >   1188			/* @parent_sq is another throl_grp, propagate dispatch */
> >   1189			if (tg->flags & THROTL_TG_WAS_EMPTY) {
> >                             ^^^^^^^^^
> > But the old code dereferences "tg" without checking.
> 
> Here if 'parent_sq' isn't NULL, tg won't be NULL, see sq_to_tg()
> 

Thanks.  It would have taken me a while to find sq_to_tg().  Smatch is
supposed to figure out this stuff but somehow it's not working.

Smatch knows that if "tg" is non-NULL then parent_sq is non-NULL.  And
it knows that if sq->parent_sq is NULL then tg is NULL.  But somehow it
can't figure out that if sq->parent_sq is non-NULL then tg is non-NULL...

:/

Something to investigate but I ran out of time today.

regards,
dan carpenter