diff options
author | Ming Lei <tom.leiming@gmail.com> | 2013-12-05 12:50:39 -0500 |
---|---|---|
committer | Jens Axboe <axboe@kernel.dk> | 2013-12-05 12:50:39 -0500 |
commit | 0d11e6aca396e679c07b2dd6af5dc8b7f041fbbd (patch) | |
tree | 70c03f4a224b9fe3e7e140881d251a9472dc6149 /block/blk-mq.c | |
parent | 959a35f13eb785f982d79b1aaa75872d05c821da (diff) |
blk-mq: fix use-after-free of request
If accounting is on, we will do the IO completion accounting after
we have freed the request. Fix that by moving it sooner instead.
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'block/blk-mq.c')
-rw-r--r-- | block/blk-mq.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/block/blk-mq.c b/block/blk-mq.c index 70fd6f996600..c79126e11030 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c | |||
@@ -312,12 +312,12 @@ void blk_mq_complete_request(struct request *rq, int error) | |||
312 | 312 | ||
313 | blk_account_io_completion(rq, bytes); | 313 | blk_account_io_completion(rq, bytes); |
314 | 314 | ||
315 | blk_account_io_done(rq); | ||
316 | |||
315 | if (rq->end_io) | 317 | if (rq->end_io) |
316 | rq->end_io(rq, error); | 318 | rq->end_io(rq, error); |
317 | else | 319 | else |
318 | blk_mq_free_request(rq); | 320 | blk_mq_free_request(rq); |
319 | |||
320 | blk_account_io_done(rq); | ||
321 | } | 321 | } |
322 | 322 | ||
323 | void __blk_mq_end_io(struct request *rq, int error) | 323 | void __blk_mq_end_io(struct request *rq, int error) |