[PATCH] null_blk: reset throttled state before device setup

[PATCH] null_blk: reset throttled state before device setup

[Miroslav Cimerman]

The NULLB_DEV_FL_THROTTLED flag is set at power on when mbps is set, and
is never cleared. Since commit 00a8cdb84fcb ("null_blk: remove
NULLB_DEV_FL_CONFIGURED on turning off nullb device") mbps can change
when the device is off. After a change to 0, the stale THROTTLED flag
sends I/O into the throttled I/O handler, whose hrtimer_active() runs on
an uninitialized timer, dereferencing a NULL pointer. A crash happens at
power on, as the first I/O that triggers the NULL dereference is
partition scanning I/O. This sequence triggers the crash:

  echo 100 > mbps; echo 1 > power; echo 0 > power; echo 0 > mbps;
  echo 1 > power

Clear the flag at the start of null_add_dev(), as is done in commit
5a4236bf2262 ("null_blk: reset cache state before device setup") for
NULLB_DEV_FL_CACHE. It is set again when mbps is set.

Fixes: 00a8cdb84fcb ("null_blk: remove NULLB_DEV_FL_CONFIGURED on turning off nullb device")
Signed-off-by: Miroslav Cimerman <mc@raidlab.org>
---
 drivers/block/null_blk/main.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c
index ec0d7ba4d938..924ec6cfdcaa 100644
--- a/drivers/block/null_blk/main.c
+++ b/drivers/block/null_blk/main.c
@@ -1977,6 +1977,7 @@ static int null_add_dev(struct nullb_device *dev)
 	if (rv)
 		return rv;
 	clear_bit(NULLB_DEV_FL_CACHE, &dev->flags);
+	clear_bit(NULLB_DEV_FL_THROTTLED, &dev->flags);
 
 	nullb = kzalloc_node(sizeof(*nullb), GFP_KERNEL, dev->home_node);
 	if (!nullb) {

base-commit: e6ac1da6a53c5f670bf09e60a2500d15be68d2fc
-- 
2.53.0