From: zhanghailiang <zhang.zhanghailiang@huawei.com>
Date: Mon, 18 Aug 2014 07:42:50 +0000 (+0800)
Subject: virtio-blk: fix reference a pointer which might be freed
X-Git-Tag: v2.1.1~40
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=2a575c450e1f1e82fb040632e3608e376c4212c2;p=thirdparty%2Fqemu.git

virtio-blk: fix reference a pointer which might be freed

In function virtio_blk_handle_request, it may freed memory pointed by req,
So do not access member of req after calling this function.

Cc: qemu-stable@nongnu.org
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: zhanghailiang <zhang.zhanghailiang@huawei.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
(cherry picked from commit 1bdb176ac5add5dc9d54a230da7511b66851f1e7)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
---

diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
index c241c5002b5..0e3925b6294 100644
--- a/hw/block/virtio-blk.c
+++ b/hw/block/virtio-blk.c
@@ -469,8 +469,9 @@ static void virtio_blk_dma_restart_bh(void *opaque)
     s->rq = NULL;
 
     while (req) {
+        VirtIOBlockReq *next = req->next;
         virtio_blk_handle_request(req, &mrb);
-        req = req->next;
+        req = next;
     }
 
     virtio_submit_multiwrite(s->bs, &mrb);