diff options
| author | Tejun Heo <htejun@gmail.com> | 2005-11-01 09:23:49 +0100 |
|---|---|---|
| committer | Linus Torvalds <torvalds@g5.osdl.org> | 2005-11-02 06:58:06 +0100 |
| commit | ca23509fbaac0ea662ab0e287bebb72f743f9e1f (patch) | |
| tree | b87f06d928e0ea06ae6244c1aeecf3e745f39bb9 /drivers/block/ioctl.c | |
| parent | [PATCH] ibmveth fix panic in initial replenish cycle (diff) | |
| download | linux-ca23509fbaac0ea662ab0e287bebb72f743f9e1f.tar.xz linux-ca23509fbaac0ea662ab0e287bebb72f743f9e1f.zip | |
[PATCH] blk: fix dangling pointer access in __elv_add_request
cfq's add_req_fn callback may invoke q->request_fn directly and
depending on low-level driver used and timing, a queued request may be
finished & deallocated before add_req_fn callback returns. So,
__elv_add_request must not access rq after it's passed to add_req_fn
callback.
This patch moves rq_mergeable test above add_req_fn(). This may
result in q->last_merge pointing to REQ_NOMERGE request if add_req_fn
callback sets it but as RQ_NOMERGE is checked again when blk layer
actually tries to merge requests, this does not cause any problem.
Signed-off-by: Tejun Heo <htejun@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'drivers/block/ioctl.c')
0 files changed, 0 insertions, 0 deletions