diff options
| author | Josef Bacik <jbacik@fb.com> | 2018-05-16 14:51:17 -0400 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2018-06-26 08:06:31 +0800 |
| commit | edee2e826640c1ba54d51914b1699bc24a1f32c9 (patch) | |
| tree | a5651f9c2b29fa53911a45139aa9707d64e88862 /drivers/block | |
| parent | ffb179cfbcf66da752524983a702e8adbaf462b7 (diff) | |
nbd: fix nbd device deletion
commit 8364da4751cf22201d74933d5e634176f44ed407 upstream.
This fixes a use after free bug, we shouldn't be doing disk->queue right
after we do del_gendisk(disk). Save the queue and do the cleanup after
the del_gendisk.
Fixes: c6a4759ea0c9 ("nbd: add device refcounting")
cc: stable@vger.kernel.org
Signed-off-by: Josef Bacik <jbacik@fb.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/block')
| -rw-r--r-- | drivers/block/nbd.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index 86258b00a1d4..7a2101030683 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -173,9 +173,12 @@ static const struct device_attribute pid_attr = { static void nbd_dev_remove(struct nbd_device *nbd) { struct gendisk *disk = nbd->disk; + struct request_queue *q; + if (disk) { + q = disk->queue; del_gendisk(disk); - blk_cleanup_queue(disk->queue); + blk_cleanup_queue(q); blk_mq_free_tag_set(&nbd->tag_set); disk->private_data = NULL; put_disk(disk); |