diff options
| author | Li Lingfeng <lilingfeng3@huawei.com> | 2023-11-07 13:34:35 +0300 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2023-11-07 18:14:57 +0300 |
| commit | 327462725b0f759f093788dfbcb2f1fd132f956b (patch) | |
| tree | ad6437b4535a62a854f869c0050eea1491b2b617 /block | |
| parent | d2f51b3516dade79269ff45eae2a7668ae711b25 (diff) | |
| download | linux-327462725b0f759f093788dfbcb2f1fd132f956b.tar.xz | |
nbd: fix uaf in nbd_open
Commit 4af5f2e03013 ("nbd: use blk_mq_alloc_disk and
blk_cleanup_disk") cleans up disk by blk_cleanup_disk() and it won't set
disk->private_data as NULL as before. UAF may be triggered in nbd_open()
if someone tries to open nbd device right after nbd_put() since nbd has
been free in nbd_dev_remove().
Fix this by implementing ->free_disk and free private data in it.
Fixes: 4af5f2e03013 ("nbd: use blk_mq_alloc_disk and blk_cleanup_disk")
Signed-off-by: Li Lingfeng <lilingfeng3@huawei.com>
Reviewed-by: Josef Bacik <josef@toxicpanda.com>
Link: https://lore.kernel.org/r/20231107103435.2074904-1-lilingfeng@huaweicloud.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'block')
0 files changed, 0 insertions, 0 deletions