diff options
author | Josef Bacik <jbacik@fb.com> | 2018-05-16 21:51:17 +0300 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2018-06-26 02:54:01 +0300 |
commit | 481684cacb2cc00cbdb35d52edb4aa5d5e3bec39 (patch) | |
tree | abc7f1b9e55e1c34fa8933c181f1cc0508efd85c | |
parent | 335136d2e26e9d09a73c9bad315f9075a7a8557f (diff) | |
download | linux-481684cacb2cc00cbdb35d52edb4aa5d5e3bec39.tar.xz |
nbd: fix nbd device deletion
commit 8364da4751cf22201d74933d5e634176f44ed407 upstream.
This fixes a use after free bug, we shouldn't be doing disk->queue right
after we do del_gendisk(disk). Save the queue and do the cleanup after
the del_gendisk.
Fixes: c6a4759ea0c9 ("nbd: add device refcounting")
cc: stable@vger.kernel.org
Signed-off-by: Josef Bacik <jbacik@fb.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-rw-r--r-- | drivers/block/nbd.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index 86258b00a1d4..7a2101030683 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -173,9 +173,12 @@ static const struct device_attribute pid_attr = { static void nbd_dev_remove(struct nbd_device *nbd) { struct gendisk *disk = nbd->disk; + struct request_queue *q; + if (disk) { + q = disk->queue; del_gendisk(disk); - blk_cleanup_queue(disk->queue); + blk_cleanup_queue(q); blk_mq_free_tag_set(&nbd->tag_set); disk->private_data = NULL; put_disk(disk); |