diff options
| author | Josef Bacik <jbacik@fb.com> | 2018-05-16 21:51:17 +0300 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2018-05-16 21:54:06 +0300 |
| commit | 8364da4751cf22201d74933d5e634176f44ed407 (patch) | |
| tree | fe9edb04edc9d882ab8a21fc64160b809481b425 /drivers/block/nbd.c | |
| parent | 3de9beeeb4ffc82c9745f095a6a26e0aef492379 (diff) | |
| download | linux-8364da4751cf22201d74933d5e634176f44ed407.tar.xz | |
nbd: fix nbd device deletion
This fixes a use after free bug, we shouldn't be doing disk->queue right
after we do del_gendisk(disk). Save the queue and do the cleanup after
the del_gendisk.
Fixes: c6a4759ea0c9 ("nbd: add device refcounting")
cc: stable@vger.kernel.org
Signed-off-by: Josef Bacik <jbacik@fb.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'drivers/block/nbd.c')
| -rw-r--r-- | drivers/block/nbd.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index afbc202ca6fd..9710a0c338b0 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -173,9 +173,12 @@ static const struct device_attribute pid_attr = { static void nbd_dev_remove(struct nbd_device *nbd) { struct gendisk *disk = nbd->disk; + struct request_queue *q; + if (disk) { + q = disk->queue; del_gendisk(disk); - blk_cleanup_queue(disk->queue); + blk_cleanup_queue(q); blk_mq_free_tag_set(&nbd->tag_set); disk->private_data = NULL; put_disk(disk); |