From: Matias Bjørling <m@bjorling.me>
Date: Mon, 28 Nov 2016 21:38:52 +0000 (+0100)
Subject: nvme: lightnvm: frees wrong cmd structure
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=7498e99fc51ca60b960ef79061e0e7b521feb07e;p=GitHub%2Fmoto-9609%2Fandroid_kernel_motorola_exynos9610.git

nvme: lightnvm: frees wrong cmd structure

When struct nvme_request was introduced, the nvme_nvm_submit_io was
converted to the new interface. The interface moves nvme_nvm_command
data structure into the struct request pdu. On io completion, rq->cmd is
freed, which should have been the dereferenced pdu nvme_request->cmd.

Fixes: d49187e97e94 "nvme: introduce struct nvme_request"
Signed-off-by: Matias Bjørling <m@bjorling.me>
Signed-off-by: Jens Axboe <axboe@fb.com>
---

diff --git a/drivers/nvme/host/lightnvm.c b/drivers/nvme/host/lightnvm.c
index 442f67774ea9..de3dc87226bb 100644
--- a/drivers/nvme/host/lightnvm.c
+++ b/drivers/nvme/host/lightnvm.c
@@ -477,7 +477,7 @@ static void nvme_nvm_end_io(struct request *rq, int error)
 	rqd->ppa_status = nvme_req(rq)->result.u64;
 	nvm_end_io(rqd, error);
 
-	kfree(rq->cmd);
+	kfree(nvme_req(rq)->cmd);
 	blk_mq_free_request(rq);
 }