[Xen-devel] [PATCH 04/10] blktap: Fix reference to freed struct request.

[Daniel Stodden <daniel.stodden@xxxxxxxxxx>]

The request will be freed by the call to __blktap_end_rq(), so rq->q
is invalid before spin_unlock_irq().

Signed-off-by: Dominic Curran <dominic.curran@xxxxxxxxxx>
Acked-by: Daniel Stodden <daniel.stodden@xxxxxxxxxx>
---
 drivers/block/blktap/device.c |    6 ++++--
 1 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/block/blktap/device.c b/drivers/block/blktap/device.c
index 9a09457..8caff9f 100644
--- a/drivers/block/blktap/device.c
+++ b/drivers/block/blktap/device.c
@@ -135,9 +135,11 @@ __blktap_end_rq(struct request *rq, int err)
 static inline void
 blktap_end_rq(struct request *rq, int err)
 {
-       spin_lock_irq(rq->q->queue_lock);
+       struct request_queue *q = rq->q;
+
+       spin_lock_irq(q->queue_lock);
        __blktap_end_rq(rq, err);
-       spin_unlock_irq(rq->q->queue_lock);
+       spin_unlock_irq(q->queue_lock);
 }
 
 void
-- 
1.7.0.4


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel