From patchwork Fri Apr 13 16:03:32 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Josef Bacik X-Patchwork-Id: 10340359 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 4E4FD6039A for ; Fri, 13 Apr 2018 16:03:39 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 43FF51FFDA for ; Fri, 13 Apr 2018 16:03:39 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 3578D20499; Fri, 13 Apr 2018 16:03:39 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 9D3991FFDA for ; Fri, 13 Apr 2018 16:03:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752487AbeDMQDh (ORCPT ); Fri, 13 Apr 2018 12:03:37 -0400 Received: from mail-qk0-f196.google.com ([209.85.220.196]:39352 "EHLO mail-qk0-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752081AbeDMQDg (ORCPT ); Fri, 13 Apr 2018 12:03:36 -0400 Received: by mail-qk0-f196.google.com with SMTP id j73so9612461qke.6 for ; Fri, 13 Apr 2018 09:03:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=toxicpanda-com.20150623.gappssmtp.com; s=20150623; h=from:to:cc:subject:date:message-id; bh=UAxa3At85tP9klDOoBbPyfiEpG2Tjpv5x6JhIRNE+mU=; b=iD6XtOtuaraoSPqfXaxJYdEJmTfvzgSG0K8d1slHdoRrmRVF1gq8cipxuQ7ZOlmtY0 3yWaaioU0sYRfgHjWqik0o4FpgNQ4O+OyYuDO6fn5m4Jcj2hDrrLBlAGbuGd61qxyOyP 3c3kHud+T4ZIrIOG/340wKr84R5BuJRAx/soa0Qm62dX8vFrxbFJGjtKFhDhp3+oV9jH S/yVXA/5eykJeqr4lFHPTodOKpzkDcPazjEshSPFipcq7L6bnoH/YG9JVYw7EvM1uSSl ERvyfmGircYx1SIy5D4K7667oPPH+Pe4n6b5oiSoONDabzXGP7pnUQ5j1WWxi+x+FfAB LuPg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=UAxa3At85tP9klDOoBbPyfiEpG2Tjpv5x6JhIRNE+mU=; b=crXyW+C1bFuPxuFml38ISDDcm5fya0UszeNT/rZG7vzVXZDx4EvSJngnrrJnTywEsw gVkgRu8fJITySNZvsgrbW47E6c3jqEG2Bbr30cvmMCA6JF43mzE9W5Gxd9Xsa+4u/5x6 vPF4PJMP5Himdg+fPybHhh8WuLq20l6ZUrR4SKM5/ZFSktkO/2xYiJk+ddsydKTlQSof 2RXm2LRYm3rwpHmcOX7c3EQjKAxADVxDQ3I/q7Kn79QQ2REKTmvpvUHKdIEQf+rEN3EA vfZ/Y+B6cbRgzHVgCrldJ8fHxnC97Gtk8z+9/rBvm27Y6UJ3vm5bkw0VM8kIomT8h5qX NUcg== X-Gm-Message-State: ALQs6tDw661o2G2S1itKwplFF5rHg3dvf8VInfwsKMvQQznmSYZ/lLBV whQxdKlikB1HLzEzk9yNCPSlAg== X-Google-Smtp-Source: AIpwx49BFfbd7BXD1aQG6vlRvcYExlNMIdBrcwJ7Cof4Sj/g6s+adZMABY2CpwCJbQ26r6D337thHg== X-Received: by 10.55.150.131 with SMTP id y125mr5215741qkd.334.1523635416120; Fri, 13 Apr 2018 09:03:36 -0700 (PDT) Received: from localhost (cpe-2606-A000-4381-1201-225-22FF-FEB3-E51A.dyn6.twc.com. [2606:a000:4381:1201:225:22ff:feb3:e51a]) by smtp.gmail.com with ESMTPSA id d84sm4892039qkb.46.2018.04.13.09.03.35 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Fri, 13 Apr 2018 09:03:35 -0700 (PDT) From: Josef Bacik To: axboe@kernel.dk, nbd@other.debian.org, linux-block@vger.kernel.org, kernel-team@fb.com, alex@iss-integration.com Cc: Josef Bacik , stable@vger.kernel.org Subject: [PATCH 1/3] nbd: del_gendisk after we cleanup the queue Date: Fri, 13 Apr 2018 12:03:32 -0400 Message-Id: <20180413160334.5496-1-josef@toxicpanda.com> X-Mailer: git-send-email 2.14.3 Sender: linux-block-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-block@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Josef Bacik This fixes a use after free bug, we need to do the del_gendisk after we cleanup the queue on the device. Fixes: c6a4759ea0c9 ("nbd: add device refcounting") cc: stable@vger.kernel.org Signed-off-by: Josef Bacik --- drivers/block/nbd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index 86258b00a1d4..e33da3e6aa20 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -174,8 +174,8 @@ static void nbd_dev_remove(struct nbd_device *nbd) { struct gendisk *disk = nbd->disk; if (disk) { - del_gendisk(disk); blk_cleanup_queue(disk->queue); + del_gendisk(disk); blk_mq_free_tag_set(&nbd->tag_set); disk->private_data = NULL; put_disk(disk);