[PATCH] blk: fix dangling pointer access in __elv_add_request

[karo-tx-linux.git] / drivers / block / elevator.c

diff --git a/drivers/block/elevator.c b/drivers/block/elevator.c
index 36f1057084b024bdc978db18d3b1fab43ecd3273..d4a49a3df829674bbb4bb476f271fc721c6fa9f3 100644 (file)
--- a/drivers/block/elevator.c
+++ b/drivers/block/elevator.c
@@ -369,9 +369,14 @@ void __elv_add_request(request_queue_t *q, struct request *rq, int where,
        case ELEVATOR_INSERT_SORT:
                BUG_ON(!blk_fs_request(rq));
                rq->flags |= REQ_SORTED;
-               q->elevator->ops->elevator_add_req_fn(q, rq);
                if (q->last_merge == NULL && rq_mergeable(rq))
                        q->last_merge = rq;
+               /*
+                * Some ioscheds (cfq) run q->request_fn directly, so
+                * rq cannot be accessed after calling
+                * elevator_add_req_fn.
+                */
+               q->elevator->ops->elevator_add_req_fn(q, rq);
                break;
 
        default: