| From 8364da4751cf22201d74933d5e634176f44ed407 Mon Sep 17 00:00:00 2001 |
| From: Josef Bacik <jbacik@fb.com> |
| Date: Wed, 16 May 2018 14:51:17 -0400 |
| Subject: nbd: fix nbd device deletion |
| |
| From: Josef Bacik <jbacik@fb.com> |
| |
| commit 8364da4751cf22201d74933d5e634176f44ed407 upstream. |
| |
| This fixes a use after free bug, we shouldn't be doing disk->queue right |
| after we do del_gendisk(disk). Save the queue and do the cleanup after |
| the del_gendisk. |
| |
| Fixes: c6a4759ea0c9 ("nbd: add device refcounting") |
| cc: stable@vger.kernel.org |
| Signed-off-by: Josef Bacik <jbacik@fb.com> |
| Signed-off-by: Jens Axboe <axboe@kernel.dk> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| drivers/block/nbd.c | 5 ++++- |
| 1 file changed, 4 insertions(+), 1 deletion(-) |
| |
| --- a/drivers/block/nbd.c |
| +++ b/drivers/block/nbd.c |
| @@ -173,9 +173,12 @@ static const struct device_attribute pid |
| static void nbd_dev_remove(struct nbd_device *nbd) |
| { |
| struct gendisk *disk = nbd->disk; |
| + struct request_queue *q; |
| + |
| if (disk) { |
| + q = disk->queue; |
| del_gendisk(disk); |
| - blk_cleanup_queue(disk->queue); |
| + blk_cleanup_queue(q); |
| blk_mq_free_tag_set(&nbd->tag_set); |
| disk->private_data = NULL; |
| put_disk(disk); |