Commit bbaa1013 authored by Linus Torvalds's avatar Linus Torvalds

Merge tag 'for-linus-20180610' of git://git.kernel.dk/linux-block

Pull block flush handling fix from Jens Axboe:
 "Single fix that we should merge now, fixing a regression in queuing
  flush request, accessing request flags after calling the end_request
  handler"

* tag 'for-linus-20180610' of git://git.kernel.dk/linux-block:
  block: fix use-after-free in block flush handling
parents d82991a8 190b02ed
...@@ -169,9 +169,11 @@ static bool blk_flush_complete_seq(struct request *rq, ...@@ -169,9 +169,11 @@ static bool blk_flush_complete_seq(struct request *rq,
struct request_queue *q = rq->q; struct request_queue *q = rq->q;
struct list_head *pending = &fq->flush_queue[fq->flush_pending_idx]; struct list_head *pending = &fq->flush_queue[fq->flush_pending_idx];
bool queued = false, kicked; bool queued = false, kicked;
unsigned int cmd_flags;
BUG_ON(rq->flush.seq & seq); BUG_ON(rq->flush.seq & seq);
rq->flush.seq |= seq; rq->flush.seq |= seq;
cmd_flags = rq->cmd_flags;
if (likely(!error)) if (likely(!error))
seq = blk_flush_cur_seq(rq); seq = blk_flush_cur_seq(rq);
...@@ -212,7 +214,7 @@ static bool blk_flush_complete_seq(struct request *rq, ...@@ -212,7 +214,7 @@ static bool blk_flush_complete_seq(struct request *rq,
BUG(); BUG();
} }
kicked = blk_kick_flush(q, fq, rq->cmd_flags); kicked = blk_kick_flush(q, fq, cmd_flags);
return kicked | queued; return kicked | queued;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment