diff options
| author | Li Lingfeng <lilingfeng3@huawei.com> | 2023-11-07 13:34:35 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2023-11-20 13:52:17 +0300 |
| commit | 4e9b3ec84dc97909876641dad14e0a2300d6c2a3 (patch) | |
| tree | df12dcc4f4d201cd49fb742fca5000cde94173e6 /block | |
| parent | b0310063d4b286abd4f15f158de7a6758de6bc8b (diff) | |
| download | linux-4e9b3ec84dc97909876641dad14e0a2300d6c2a3.tar.xz | |
nbd: fix uaf in nbd_open
[ Upstream commit 327462725b0f759f093788dfbcb2f1fd132f956b ]
Commit 4af5f2e03013 ("nbd: use blk_mq_alloc_disk and
blk_cleanup_disk") cleans up disk by blk_cleanup_disk() and it won't set
disk->private_data as NULL as before. UAF may be triggered in nbd_open()
if someone tries to open nbd device right after nbd_put() since nbd has
been free in nbd_dev_remove().
Fix this by implementing ->free_disk and free private data in it.
Fixes: 4af5f2e03013 ("nbd: use blk_mq_alloc_disk and blk_cleanup_disk")
Signed-off-by: Li Lingfeng <lilingfeng3@huawei.com>
Reviewed-by: Josef Bacik <josef@toxicpanda.com>
Link: https://lore.kernel.org/r/20231107103435.2074904-1-lilingfeng@huaweicloud.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'block')
0 files changed, 0 insertions, 0 deletions