From mboxrd@z Thu Jan  1 00:00:00 1970
From: Dominic Curran <dominic.curran@citrix.com>
Subject: blktap: fix reference to freed struct request.
Date: Tue, 8 Mar 2011 18:18:31 +0000
Message-ID: <4D7672F7.1040805@citrix.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="ISO-8859-1"; format=flowed
Content-Transfer-Encoding: 7bit
Return-path: <xen-devel-bounces@lists.xensource.com>
List-Unsubscribe: <http://lists.xensource.com/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xensource.com?subject=unsubscribe>
List-Post: <mailto:xen-devel@lists.xensource.com>
List-Help: <mailto:xen-devel-request@lists.xensource.com?subject=help>
List-Subscribe: <http://lists.xensource.com/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xensource.com?subject=subscribe>
Sender: xen-devel-bounces@lists.xensource.com
Errors-To: xen-devel-bounces@lists.xensource.com
To: xen-devel@lists.xensource.com
List-Id: xen-devel@lists.xenproject.org

blktap: fix reference to freed struct request.

The request will be freed by the call to __blktap_end_rq(), so to
rq->q is invalid before spin_unlock_irq().

Signed-off-by: Dominic Curran <dominic.curran@
Acked-by: Daniel Stodden <daniel.stodden@citrix.com>

diff -r d971c4c2e309 drivers/xen/blktap2/device.c
--- a/drivers/xen/blktap2/device.c    Tue Mar 08 10:02:58 2011 -0800
+++ b/drivers/xen/blktap2/device.c    Tue Mar 08 10:04:28 2011 -0800
@@ -135,9 +135,11 @@
 static inline void
 blktap_end_rq(struct request *rq, int err)
 {
-    spin_lock_irq(rq->q->queue_lock);
+    struct request_queue *q = rq->q;
+
+    spin_lock_irq(q->queue_lock);
     __blktap_end_rq(rq, err);
-    spin_unlock_irq(rq->q->queue_lock);
+    spin_unlock_irq(q->queue_lock);
 }
 
 void