Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c6bb501a authored by qctecmdr's avatar qctecmdr Committed by Gerrit - the friendly Code Review server
Browse files

Merge "block: Fix use-after-free while iterating over requests"

parents 9c4ab1cf 10ee57c2

block/blk-mq.c

+1 −0
Original line number Diff line number Diff line
@@ -497,6 +497,7 @@ static void __blk_mq_free_request(struct request *rq) 
	const int sched_tag = rq->internal_tag;



	blk_pm_mark_last_busy(rq);

	hctx->tags->rqs[rq->tag] = NULL;

	rq->mq_hctx = NULL;

	if (rq->tag != -1)

		blk_mq_put_tag(hctx, hctx->tags, ctx, rq->tag);

block/blk-mq.h

+1 −1
Original line number Diff line number Diff line
@@ -209,6 +209,7 @@ static inline bool blk_mq_get_dispatch_budget(struct blk_mq_hw_ctx *hctx) 
static inline void __blk_mq_put_driver_tag(struct blk_mq_hw_ctx *hctx,

					   struct request *rq)

{

	hctx->tags->rqs[rq->tag] = NULL;

	blk_mq_put_tag(hctx, hctx->tags, rq->mq_ctx, rq->tag);

	rq->tag = -1;
@@ -222,7 +223,6 @@ static inline void blk_mq_put_driver_tag(struct request *rq) 
{

	if (rq->tag == -1 || rq->internal_tag == -1)

		return;



	__blk_mq_put_driver_tag(rq->mq_hctx, rq);

}