Skip to content

Commit

Permalink
nbd: fix nbd device deletion
Browse files Browse the repository at this point in the history
This fixes a use after free bug, we shouldn't be doing disk->queue right
after we do del_gendisk(disk).  Save the queue and do the cleanup after
the del_gendisk.

Fixes: c6a4759 ("nbd: add device refcounting")
cc: stable@vger.kernel.org
Signed-off-by: Josef Bacik <jbacik@fb.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
  • Loading branch information
Josef Bacik authored and Jens Axboe committed May 16, 2018
1 parent 3de9bee commit 8364da4
Showing 1 changed file with 4 additions and 1 deletion.
5 changes: 4 additions & 1 deletion drivers/block/nbd.c
Original file line number Diff line number Diff line change
Expand Up @@ -173,9 +173,12 @@ static const struct device_attribute pid_attr = {
static void nbd_dev_remove(struct nbd_device *nbd)
{
struct gendisk *disk = nbd->disk;
struct request_queue *q;

if (disk) {
q = disk->queue;
del_gendisk(disk);
blk_cleanup_queue(disk->queue);
blk_cleanup_queue(q);
blk_mq_free_tag_set(&nbd->tag_set);
disk->private_data = NULL;
put_disk(disk);
Expand Down

0 comments on commit 8364da4

Please sign in to comment.