Commit 8364da47 authored May 16, 2018 by Josef Bacik Committed by Jens Axboe May 16, 2018

nbd: fix nbd device deletion



This fixes a use after free bug, we shouldn't be doing disk->queue right
after we do del_gendisk(disk).  Save the queue and do the cleanup after
the del_gendisk.

Fixes: c6a4759e ("nbd: add device refcounting")
cc: stable@vger.kernel.org
Signed-off-by: Josef Bacik <jbacik@fb.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

parent 3de9beee

drivers/block/nbd.c

+4 −1

Original line number	Diff line number	Diff line
		@@ -173,9 +173,12 @@ static const struct device_attribute pid_attr = {
		static void nbd_dev_remove(struct nbd_device *nbd)
		{
		struct gendisk *disk = nbd->disk;
		struct request_queue *q;

		if (disk) {
		q = disk->queue;
		del_gendisk(disk);
		blk_cleanup_queue(disk->queue);
		blk_cleanup_queue(q);
		blk_mq_free_tag_set(&nbd->tag_set);
		disk->private_data = NULL;
		put_disk(disk);