diff mbox series

[v3,5/5] nbd: don't start request if nbd_queue_rq() failed

Message ID 20210824141227.808340-6-yukuai3@huawei.com (mailing list archive)
State New, archived
Headers show
Series fix request uaf in nbd_read_stat() | expand

Commit Message

Yu Kuai Aug. 24, 2021, 2:12 p.m. UTC 
Currently, blk_mq_end_request() will be called if nbd_queue_rq()
failed, thus start request in such situation is useless.

Signed-off-by: Yu Kuai <yukuai3@huawei.com>
---
 drivers/block/nbd.c | 3 ---
 1 file changed, 3 deletions(-)
diff mbox series

Patch

diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index 4d5098d01758..c22dbb9b5065 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -944,7 +944,6 @@  static int nbd_handle_cmd(struct nbd_cmd *cmd, int index)
 	if (!refcount_inc_not_zero(&nbd->config_refs)) {
 		dev_err_ratelimited(disk_to_dev(nbd->disk),
 				    "Socks array is empty\n");
-		blk_mq_start_request(req);
 		return -EINVAL;
 	}
 	config = nbd->config;
@@ -953,7 +952,6 @@  static int nbd_handle_cmd(struct nbd_cmd *cmd, int index)
 		dev_err_ratelimited(disk_to_dev(nbd->disk),
 				    "Attempted send on invalid socket\n");
 		nbd_config_put(nbd);
-		blk_mq_start_request(req);
 		return -EINVAL;
 	}
 	cmd->status = BLK_STS_OK;
@@ -977,7 +975,6 @@  static int nbd_handle_cmd(struct nbd_cmd *cmd, int index)
 			 */
 			sock_shutdown(nbd);
 			nbd_config_put(nbd);
-			blk_mq_start_request(req);
 			return -EIO;
 		}
 		goto again;