mmc: cmdq: fixing use-after-free error

Fixed use-after-free error reported by KASAN
>>>
[   95.547234] BUG: KASAN: use-after-free in mmc_blk_cmdq_complete_rq+0x1d8/0x248 at addr ffffffc1a3d34f60
[   95.556609] Read of size 8 by task mmc_cmdq_d/0/123
[   95.561475] =============================================================================
[   95.569637] BUG blkdev_requests (Tainted: G    B          ): kasan: bad access detected
[   95.577623] -----------------------------------------------------------------------------
>>>

Bug 200248998

Change-Id: I2a5251a5a2c898b6377ca90473b3fc029d51d955
Signed-off-by: R Raj Kumar <rrajk@nvidia.com>
Reviewed-on: http://git-master/r/1296642
Reviewed-by: svccoveritychecker <svccoveritychecker@nvidia.com>
Reviewed-by: Pavan Kunapuli <pkunapuli@nvidia.com>
GVS: Gerrit_Virtual_Submit
Reviewed-by: Venu Byravarasu <vbyravarasu@nvidia.com>

diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
index 40a63688e69ea1bbebc6c343f0de2b6553bac892..426c3d354af05dc5ec085799db7166980fcb4a7c 100644 (file)
--- a/drivers/mmc/card/block.c
+++ b/drivers/mmc/card/block.c
@@ -2618,10 +2618,10 @@ int mmc_blk_cmdq_complete_rq(struct request *rq)
                return 0;
        }
 
-       blk_end_request(rq, 0, cmdq_req->data.bytes_xfered);
-
        if (test_and_clear_bit(0, &ctx_info->req_starved))
                blk_run_queue(rq->q);
+
+       blk_end_request(rq, 0, cmdq_req->data.bytes_xfered);
        return 0;
 }