On Tue 08 Sep 2026 04:55:53 PM +02, Denis V. Lunev wrote: > throttle_group_register_tgm() stores tgm->throttle_state before it takes > tg->lock, so the I/O path can see a member whose group still has NULL > tokens[] and an empty member list. A request in an iothread then reaches > throttle_group_co_io_limits_intercept(), wins tg->lock ahead of the > registering thread, and next_throttle_token() passes the NULL token to > throttle_group_next_tgm(), which dereferences it:
Acked-by: Alberto Garcia <[email protected]> Berto
