On 8/12/19 5:36 AM, zhengbin wrote: > blk_exit_queue will free elevator_data, while blk_mq_requeue_work > will access it. Move cancel of requeue_work to the front of > blk_exit_queue to avoid use-after-free. > > blk_exit_queue blk_mq_requeue_work > __elevator_exit blk_mq_run_hw_queues > blk_mq_exit_sched blk_mq_run_hw_queue > dd_exit_queue blk_mq_hctx_has_pending > kfree(elevator_data) blk_mq_sched_has_work > dd_has_work
Applied, thanks. -- Jens Axboe
