On Mon, Aug 31, 2020 at 06:55:53PM +0800, Xianting Tian wrote: > As blk_mq_tag_to_rq() may return null, so it should be check whether it is > null before using it to prevent a crash.
It may return NULL if the command id exceeds the number of tags. We already have a check for a valid command id value, so something is not adding up here if we're still getting NULL. > req = blk_mq_tag_to_rq(nvme_queue_tagset(nvmeq), cqe->command_id); > + if (unlikely(!req)) { > + dev_warn(nvmeq->dev->ctrl.device, > + "req is null(tag:%d) on queue %d\n", > + cqe->command_id, le16_to_cpu(cqe->sq_id)); > + return; > + }