diff options
Diffstat (limited to 'block/blk-flush.c')
| -rw-r--r-- | block/blk-flush.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/block/blk-flush.c b/block/blk-flush.c index 996d5d03dade..76c1624cb06c 100644 --- a/block/blk-flush.c +++ b/block/blk-flush.c @@ -224,13 +224,18 @@ static void flush_end_io(struct request *flush_rq, blk_status_t error) /* release the tag's ownership to the req cloned from */ spin_lock_irqsave(&fq->mq_flush_lock, flags); - WRITE_ONCE(flush_rq->state, MQ_RQ_IDLE); if (!refcount_dec_and_test(&flush_rq->ref)) { fq->rq_status = error; spin_unlock_irqrestore(&fq->mq_flush_lock, flags); return; } + /* + * Flush request has to be marked as IDLE when it is really ended + * because its .end_io() is called from timeout code path too for + * avoiding use-after-free. + */ + WRITE_ONCE(flush_rq->state, MQ_RQ_IDLE); if (fq->rq_status != BLK_STS_OK) error = fq->rq_status; |