summaryrefslogtreecommitdiffstats
path: root/block/blk-mq.c
diff options
context:
space:
mode:
authorMing Lei2013-12-05 18:50:39 +0100
committerJens Axboe2013-12-05 18:50:39 +0100
commit0d11e6aca396e679c07b2dd6af5dc8b7f041fbbd (patch)
tree70c03f4a224b9fe3e7e140881d251a9472dc6149 /block/blk-mq.c
parentblk-mq: fix dereference of rq->mq_ctx if allocation fails (diff)
downloadkernel-qcow2-linux-0d11e6aca396e679c07b2dd6af5dc8b7f041fbbd.tar.gz
kernel-qcow2-linux-0d11e6aca396e679c07b2dd6af5dc8b7f041fbbd.tar.xz
kernel-qcow2-linux-0d11e6aca396e679c07b2dd6af5dc8b7f041fbbd.zip
blk-mq: fix use-after-free of request
If accounting is on, we will do the IO completion accounting after we have freed the request. Fix that by moving it sooner instead. Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'block/blk-mq.c')
-rw-r--r--block/blk-mq.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 70fd6f996600..c79126e11030 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -312,12 +312,12 @@ void blk_mq_complete_request(struct request *rq, int error)
blk_account_io_completion(rq, bytes);
+ blk_account_io_done(rq);
+
if (rq->end_io)
rq->end_io(rq, error);
else
blk_mq_free_request(rq);
-
- blk_account_io_done(rq);
}
void __blk_mq_end_io(struct request *rq, int error)