tree 98b0c20ad616258dae150a04307ce3a2ad90adf1
parent 7ff9057db7edeb210fd5c00314c52154922d8868
author Jeff Dike <jdike@addtoit.com> 1184567927 -0700
committer Linus Torvalds <torvalds@woody.linux-foundation.org> 1184601938 -0700

uml: fix request->sector update

It is theoretically possible for a request to finish and be freed between
writing it to the I/O thread and updating the sector count.  In this case, the
update will dereference a freed pointer.

To avoid this, I delay the update until processing the next sg segment, when
the request pointer is known to be good.

Signed-off-by: Jeff Dike <jdike@linux.intel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>