[rh7,5/8] nbd: fix nbd device deletion

Submitted by Andrey Ryabinin on Nov. 1, 2019, 7:12 p.m.

Details

Message ID 20191101191218.31833-5-aryabinin@virtuozzo.com
State New
Series "Series without cover letter"
Headers show

Commit Message

Andrey Ryabinin Nov. 1, 2019, 7:12 p.m.
From: Josef Bacik <jbacik@fb.com>

This fixes a use after free bug, we shouldn't be doing disk->queue right
after we do del_gendisk(disk).  Save the queue and do the cleanup after
the del_gendisk.

Fixes: c6a4759ea0c9 ("nbd: add device refcounting")
cc: stable@vger.kernel.org
Signed-off-by: Josef Bacik <jbacik@fb.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

https://jira.sw.ru/browse/PSBM-99102
(cherry picked from commit 8364da4751cf22201d74933d5e634176f44ed407)
Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
---
 drivers/block/nbd.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

Patch hide | download patch | download mbox

diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index 9e0450300cc1..ea5880077933 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -154,9 +154,12 @@  static struct device_attribute pid_attr = {
 static void nbd_dev_remove(struct nbd_device *nbd)
 {
 	struct gendisk *disk = nbd->disk;
+	struct request_queue *q;
+
 	if (disk) {
+		q = disk->queue;
 		del_gendisk(disk);
-		blk_cleanup_queue(disk->queue);
+		blk_cleanup_queue(q);
 		blk_mq_free_tag_set(&nbd->tag_set);
 		put_disk(disk);
 	}