aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorTejun Heo2005-11-01 17:23:49 +0900
committerLinus Torvalds2005-11-01 21:58:06 -0800
commitca23509fbaac0ea662ab0e287bebb72f743f9e1f (patch)
treeb87f06d928e0ea06ae6244c1aeecf3e745f39bb9
parent6c2af71f7f6ac10ab45e9461e1dd7aa09079643a (diff)
[PATCH] blk: fix dangling pointer access in __elv_add_request
cfq's add_req_fn callback may invoke q->request_fn directly and depending on low-level driver used and timing, a queued request may be finished & deallocated before add_req_fn callback returns. So, __elv_add_request must not access rq after it's passed to add_req_fn callback. This patch moves rq_mergeable test above add_req_fn(). This may result in q->last_merge pointing to REQ_NOMERGE request if add_req_fn callback sets it but as RQ_NOMERGE is checked again when blk layer actually tries to merge requests, this does not cause any problem. Signed-off-by: Tejun Heo <htejun@gmail.com> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
-rw-r--r--drivers/block/elevator.c7
1 files changed, 6 insertions, 1 deletions
diff --git a/drivers/block/elevator.c b/drivers/block/elevator.c
index 36f1057084b0..d4a49a3df829 100644
--- a/drivers/block/elevator.c
+++ b/drivers/block/elevator.c
@@ -369,9 +369,14 @@ void __elv_add_request(request_queue_t *q, struct request *rq, int where,
case ELEVATOR_INSERT_SORT:
BUG_ON(!blk_fs_request(rq));
rq->flags |= REQ_SORTED;
- q->elevator->ops->elevator_add_req_fn(q, rq);
if (q->last_merge == NULL && rq_mergeable(rq))
q->last_merge = rq;
+ /*
+ * Some ioscheds (cfq) run q->request_fn directly, so
+ * rq cannot be accessed after calling
+ * elevator_add_req_fn.
+ */
+ q->elevator->ops->elevator_add_req_fn(q, rq);
break;
default: