nbd: fix use-after-free of rq/bio in the xmit path
authorJens Axboe <axboe@fb.com>
Thu, 17 Nov 2016 19:30:37 +0000 (12:30 -0700)
committerJens Axboe <axboe@fb.com>
Thu, 17 Nov 2016 19:30:37 +0000 (12:30 -0700)
commit429a787be6793554ee02aacc7e1f11ebcecc4453
treeb7a533b7db0cc2752f49e99fed7d6f4d2af45065
parent4121d385f1457d9beb2067d4b5b4659ef3e6c316
nbd: fix use-after-free of rq/bio in the xmit path

For writes, we can get a completion in while we're still iterating
the request and bio chain. If that happens, we're reading freed
memory and we can crash.

Break out after the last segment and avoid having the iterator
read freed memory.

Reviewed-by: Josef Bacik <jbacik@fb.com>
Signed-off-by: Jens Axboe <axboe@fb.com>
drivers/block/nbd.c