blk-mq: fix use-after-free of request
authorMing Lei <tom.leiming@gmail.com>
Thu, 5 Dec 2013 17:50:39 +0000 (10:50 -0700)
committerJens Axboe <axboe@kernel.dk>
Thu, 5 Dec 2013 17:50:39 +0000 (10:50 -0700)
If accounting is on, we will do the IO completion accounting after
we have freed the request. Fix that by moving it sooner instead.

Signed-off-by: Jens Axboe <axboe@kernel.dk>
block/blk-mq.c

index 70fd6f9966006f185492be2483d7656fab725a52..c79126e110308e8b1ea4b322506a425ceeb3085c 100644 (file)
@@ -312,12 +312,12 @@ void blk_mq_complete_request(struct request *rq, int error)
 
        blk_account_io_completion(rq, bytes);
 
+       blk_account_io_done(rq);
+
        if (rq->end_io)
                rq->end_io(rq, error);
        else
                blk_mq_free_request(rq);
-
-       blk_account_io_done(rq);
 }
 
 void __blk_mq_end_io(struct request *rq, int error)