[RHEL7,COMMIT] ms/nbd: fix nbd device deletion

Submitted by Konstantin Khorenko on Nov. 5, 2019, 8:06 a.m.


Message ID 201911050806.xA586G5C015975@finist-ce7.sw.ru
State New
Series "Series without cover letter"
Headers show

Commit Message

Konstantin Khorenko Nov. 5, 2019, 8:06 a.m.
The commit is pushed to "branch-rh7-3.10.0-1062.4.1.vz7.115.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-1062.4.1.vz7.115.7
commit 1c66b6a20827805f42d90f7c1e07b185b32b94ba
Author: Josef Bacik <jbacik@fb.com>
Date:   Tue Nov 5 11:06:16 2019 +0300

    ms/nbd: fix nbd device deletion
    This fixes a use after free bug, we shouldn't be doing disk->queue right
    after we do del_gendisk(disk).  Save the queue and do the cleanup after
    the del_gendisk.
    Fixes: c6a4759ea0c9 ("nbd: add device refcounting")
    cc: stable@vger.kernel.org
    Signed-off-by: Josef Bacik <jbacik@fb.com>
    Signed-off-by: Jens Axboe <axboe@kernel.dk>
    (cherry picked from commit 8364da4751cf22201d74933d5e634176f44ed407)
    Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
 drivers/block/nbd.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

Patch hide | download patch | download mbox

diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index 9e0450300cc1..ea5880077933 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -154,9 +154,12 @@  static struct device_attribute pid_attr = {
 static void nbd_dev_remove(struct nbd_device *nbd)
 	struct gendisk *disk = nbd->disk;
+	struct request_queue *q;
 	if (disk) {
+		q = disk->queue;
-		blk_cleanup_queue(disk->queue);
+		blk_cleanup_queue(q);