[PATCH] request structure stack corruption

This fixes a problem with drivers that have request on the stack for
some operations, like IDE.  If we wake before releasing the request, the
stack may have already disappeared beneath us when the rest of
end_that_request_last() is run.

Fix by making sure the completion is done _last_.

diff --git a/drivers/block/ll_rw_blk.c b/drivers/block/ll_rw_blk.c
index 74d8e2e0f8dbcc7c062c183495900eb233cc9705..ad6e7b62e66f9ed9349c547733509ce6c286945c 100644 (file)
--- a/drivers/block/ll_rw_blk.c
+++ b/drivers/block/ll_rw_blk.c
@@ -2164,8 +2164,7 @@ int end_that_request_chunk(struct request *req, int uptodate, int nr_bytes)
 void end_that_request_last(struct request *req)
 {
        struct gendisk *disk = req->rq_disk;
-       if (req->waiting)
-               complete(req->waiting);
+       struct completion *waiting = req->waiting;
 
        if (disk) {
                unsigned long duration = jiffies - req->start_time;
@@ -2183,6 +2182,9 @@ void end_that_request_last(struct request *req)
                disk_stat_dec(disk, in_flight);
        }
        __blk_put_request(req->q, req);
+       /* Do this LAST! The structure may be freed immediately afterwards */
+       if (waiting)
+               complete(waiting);
 }
 
 int __init blk_dev_init(void)