Dominic Curran
2011-Mar-08 18:18 UTC
[Xen-devel] blktap: fix reference to freed struct request.
blktap: fix reference to freed struct request.
The request will be freed by the call to __blktap_end_rq(), so to
rq->q is invalid before spin_unlock_irq().
Signed-off-by: Dominic Curran <dominic.curran@
Acked-by: Daniel Stodden <daniel.stodden@citrix.com>
diff -r d971c4c2e309 drivers/xen/blktap2/device.c
--- a/drivers/xen/blktap2/device.c Tue Mar 08 10:02:58 2011 -0800
+++ b/drivers/xen/blktap2/device.c Tue Mar 08 10:04:28 2011 -0800
@@ -135,9 +135,11 @@
static inline void
blktap_end_rq(struct request *rq, int err)
{
- spin_lock_irq(rq->q->queue_lock);
+ struct request_queue *q = rq->q;
+
+ spin_lock_irq(q->queue_lock);
__blktap_end_rq(rq, err);
- spin_unlock_irq(rq->q->queue_lock);
+ spin_unlock_irq(q->queue_lock);
}
void
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel
Daniel Stodden
2011-Mar-08 18:44 UTC
Re: [Xen-devel] blktap: fix reference to freed struct request.
On Tue, 2011-03-08 at 13:18 -0500, Dominic Curran wrote:> blktap: fix reference to freed struct request. > > The request will be freed by the call to __blktap_end_rq(), so to > rq->q is invalid before spin_unlock_irq(). > > Signed-off-by: Dominic Curran <dominic.curran@... citrix.com> My fault, I wasn''t sure about the uk mx names anymore. Sorry, Daniel> Acked-by: Daniel Stodden <daniel.stodden@citrix.com> > > diff -r d971c4c2e309 drivers/xen/blktap2/device.c > --- a/drivers/xen/blktap2/device.c Tue Mar 08 10:02:58 2011 -0800 > +++ b/drivers/xen/blktap2/device.c Tue Mar 08 10:04:28 2011 -0800 > @@ -135,9 +135,11 @@ > static inline void > blktap_end_rq(struct request *rq, int err) > { > - spin_lock_irq(rq->q->queue_lock); > + struct request_queue *q = rq->q; > + > + spin_lock_irq(q->queue_lock); > __blktap_end_rq(rq, err); > - spin_unlock_irq(rq->q->queue_lock); > + spin_unlock_irq(q->queue_lock); > } > > void > > _______________________________________________ > Xen-devel mailing list > Xen-devel@lists.xensource.com > http://lists.xensource.com/xen-devel_______________________________________________ Xen-devel mailing list Xen-devel@lists.xensource.com http://lists.xensource.com/xen-devel
Keir Fraser
2011-Mar-08 18:57 UTC
Re: [Xen-devel] blktap: fix reference to freed struct request.
On 08/03/2011 18:18, "Dominic Curran" <dominic.curran@citrix.com> wrote:> blktap: fix reference to freed struct request. > > The request will be freed by the call to __blktap_end_rq(), so to > rq->q is invalid before spin_unlock_irq().What tree is this for? Otherwise this could get dropped on the floor. If it''s for 2.6.18, the only tree that I''m still responsible for, then it needs 2.6.18 mentioned in the subject line. -- Keir> Signed-off-by: Dominic Curran <dominic.curran@ > Acked-by: Daniel Stodden <daniel.stodden@citrix.com> > > diff -r d971c4c2e309 drivers/xen/blktap2/device.c > --- a/drivers/xen/blktap2/device.c Tue Mar 08 10:02:58 2011 -0800 > +++ b/drivers/xen/blktap2/device.c Tue Mar 08 10:04:28 2011 -0800 > @@ -135,9 +135,11 @@ > static inline void > blktap_end_rq(struct request *rq, int err) > { > - spin_lock_irq(rq->q->queue_lock); > + struct request_queue *q = rq->q; > + > + spin_lock_irq(q->queue_lock); > __blktap_end_rq(rq, err); > - spin_unlock_irq(rq->q->queue_lock); > + spin_unlock_irq(q->queue_lock); > } > > void > > _______________________________________________ > Xen-devel mailing list > Xen-devel@lists.xensource.com > http://lists.xensource.com/xen-devel_______________________________________________ Xen-devel mailing list Xen-devel@lists.xensource.com http://lists.xensource.com/xen-devel
Daniel Stodden
2011-Mar-08 19:09 UTC
Re: [Xen-devel] blktap: fix reference to freed struct request.
On Tue, 2011-03-08 at 13:57 -0500, Keir Fraser wrote:> On 08/03/2011 18:18, "Dominic Curran" <dominic.curran@citrix.com> wrote: > > > blktap: fix reference to freed struct request. > > > > The request will be freed by the call to __blktap_end_rq(), so to > > rq->q is invalid before spin_unlock_irq(). > > What tree is this for? Otherwise this could get dropped on the floor. If > it''s for 2.6.18, the only tree that I''m still responsible for, then it needs > 2.6.18 mentioned in the subject line.This should go into the pvops tree (but will need some path fixup) and ideally goes into stable branch(es?) straight away. 2.6.18 won''t have that particular bug, unless that code was patched in. Daniel> -- Keir > > > Signed-off-by: Dominic Curran <dominic.curran@ > > Acked-by: Daniel Stodden <daniel.stodden@citrix.com> > > > > diff -r d971c4c2e309 drivers/xen/blktap2/device.c > > --- a/drivers/xen/blktap2/device.c Tue Mar 08 10:02:58 2011 -0800 > > +++ b/drivers/xen/blktap2/device.c Tue Mar 08 10:04:28 2011 -0800 > > @@ -135,9 +135,11 @@ > > static inline void > > blktap_end_rq(struct request *rq, int err) > > { > > - spin_lock_irq(rq->q->queue_lock); > > + struct request_queue *q = rq->q; > > + > > + spin_lock_irq(q->queue_lock); > > __blktap_end_rq(rq, err); > > - spin_unlock_irq(rq->q->queue_lock); > > + spin_unlock_irq(q->queue_lock); > > } > > > > void > > > > _______________________________________________ > > Xen-devel mailing list > > Xen-devel@lists.xensource.com > > http://lists.xensource.com/xen-devel > > > > _______________________________________________ > Xen-devel mailing list > Xen-devel@lists.xensource.com > http://lists.xensource.com/xen-devel_______________________________________________ Xen-devel mailing list Xen-devel@lists.xensource.com http://lists.xensource.com/xen-devel