Commit 0d11e6ac authored by Ming Lei's avatar Ming Lei Committed by Jens Axboe
Browse files

blk-mq: fix use-after-free of request 



If accounting is on, we will do the IO completion accounting after
we have freed the request. Fix that by moving it sooner instead.

Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 959a35f1

block/blk-mq.c

+2 −2
Original line number Original line Diff line number Diff line
@@ -312,12 +312,12 @@ void blk_mq_complete_request(struct request *rq, int error) 




	blk_account_io_completion(rq, bytes);

	blk_account_io_completion(rq, bytes);





	blk_account_io_done(rq);



	if (rq->end_io)

	if (rq->end_io)

		rq->end_io(rq, error);

		rq->end_io(rq, error);

	else

	else

		blk_mq_free_request(rq);

		blk_mq_free_request(rq);



	blk_account_io_done(rq);

}

}





void __blk_mq_end_io(struct request *rq, int error)

void __blk_mq_end_io(struct request *rq, int error)