tree 227d28d4d7eeb88c4bc882c185a014eeab67c9ee
parent c01a21b77722db0474bbcc4eafc8c4e0d8fed6d8
author Ming Lei <ming.lei@redhat.com> 1605275088 +0800
committer Jens Axboe <axboe@kernel.dk> 1605302656 -0700

block: mark flush request as IDLE when it is really finished

For avoiding use-after-free on flush request, we call its .end_io() from
both timeout code path and __blk_mq_end_request().

When flush request's ref doesn't drop to zero, it is still used, we
can't mark it as IDLE, so fix it by marking IDLE when its refcount drops
to zero really.

Fixes: 65ff5cd04551 ("blk-mq: mark flush request as IDLE in flush_end_io()")
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Cc: Yi Zhang <yi.zhang@redhat.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>