From patchwork Wed May 16 18:51:17 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Josef Bacik X-Patchwork-Id: 10404661 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id A7FCC601F7 for ; Wed, 16 May 2018 18:51:29 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 97F8428384 for ; Wed, 16 May 2018 18:51:29 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 8CD30285E8; Wed, 16 May 2018 18:51:29 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 3FF7828384 for ; Wed, 16 May 2018 18:51:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751062AbeEPSv1 (ORCPT ); Wed, 16 May 2018 14:51:27 -0400 Received: from mail-qt0-f193.google.com ([209.85.216.193]:35033 "EHLO mail-qt0-f193.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750775AbeEPSv0 (ORCPT ); Wed, 16 May 2018 14:51:26 -0400 Received: by mail-qt0-f193.google.com with SMTP id f5-v6so2485374qth.2 for ; Wed, 16 May 2018 11:51:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=toxicpanda-com.20150623.gappssmtp.com; s=20150623; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=YCqOx9CW6nHEjnrB/1rgMm43udu9axW4o+lwAxddM+E=; b=ZkOTepkB4PB/NxaTbUYOrvCSDV0I5TGhEefyHUFkaW54iARMt9kI7gSXFpicXsGWtA hFBbpgvuguXP8ggZ+7+aWPn7Gxu8ljXePJx/64CFVBTbU/cq1oCRLJqxrDoHJE/IKQmp EdryWLK/ux7uxAQi8cYl17WLV6TXmQMj5vWjuBAEkSYbwlEghXPP8MRsc+T/fKa1DECU v9rYp9x/nJa8DjrKqfxD6QlKaGJmm5UenTMRDv84eGBaHzmO1NfnVchnFDN9EAj28WG4 e8NmCKOU3eU5pT3DDMDDut53rNtAONczmiTLETzBiw3Jfq0n/ZyyapciEcWAAlqZYOML IRdg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=YCqOx9CW6nHEjnrB/1rgMm43udu9axW4o+lwAxddM+E=; b=C1ysEOrANCXReseGtEQRBRjERF5gtDjmkfpm6rl/YE02FDBlMgvUiVJhX4oXFGsODA YIAuGKAQHVNXonJbIQAstm8gfTGq/UsQOLNH+4Sw6KFqcVWxF/D1j4eg6+txDzB9QIqB yoU7rC1j96riMjRxkRoU6m6/bBUF1J7rI8nIV7fk/CujbvU/PasHeXAYRflIfRkSoP0y rpsvzfjFZfDpUmV0XAso4hps9fnuoL8MHq1hfTxviAAsvO6GQPza7EfmhuCF1HTcMICq GMxY8T4PCmBho54DP2GNyGUfsZfXsOw7C7lku9u91fk8uM9E9VkWNn6n6aoBPX/uBcDi HDgQ== X-Gm-Message-State: ALKqPwc68bJ3qwwsTEYVOR01juEQUWUQ8iKaLUuooJIq+EGnoxk1BNpU v4GS8X2A9So1H4A/j3u8ZFnPNw== X-Google-Smtp-Source: AB8JxZqBY2N2MZ04kHScYtcPZ/IZFojhD+jwxlhLIT5tu8mDD6a4WDRqA4HV6dkWEvO9r5I10UD/zg== X-Received: by 2002:ac8:41cc:: with SMTP id o12-v6mr2259042qtm.227.1526496686065; Wed, 16 May 2018 11:51:26 -0700 (PDT) Received: from localhost (cpe-2606-A000-4381-1201-225-22FF-FEB3-E51A.dyn6.twc.com. [2606:a000:4381:1201:225:22ff:feb3:e51a]) by smtp.gmail.com with ESMTPSA id d193-v6sm2277196qke.93.2018.05.16.11.51.25 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Wed, 16 May 2018 11:51:25 -0700 (PDT) From: Josef Bacik To: axboe@kernel.dk, nbd@other.debian.org, linux-block@vger.kernel.org, kernel-team@fb.com Cc: Josef Bacik , stable@vger.kernel.org Subject: [PATCH 2/7] nbd: fix nbd device deletion Date: Wed, 16 May 2018 14:51:17 -0400 Message-Id: <20180516185122.18590-2-josef@toxicpanda.com> X-Mailer: git-send-email 2.14.3 In-Reply-To: <20180516185122.18590-1-josef@toxicpanda.com> References: <20180516185122.18590-1-josef@toxicpanda.com> Sender: linux-block-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-block@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Josef Bacik This fixes a use after free bug, we shouldn't be doing disk->queue right after we do del_gendisk(disk). Save the queue and do the cleanup after the del_gendisk. Fixes: c6a4759ea0c9 ("nbd: add device refcounting") cc: stable@vger.kernel.org Signed-off-by: Josef Bacik --- drivers/block/nbd.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index afbc202ca6fd..9710a0c338b0 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -173,9 +173,12 @@ static const struct device_attribute pid_attr = { static void nbd_dev_remove(struct nbd_device *nbd) { struct gendisk *disk = nbd->disk; + struct request_queue *q; + if (disk) { + q = disk->queue; del_gendisk(disk); - blk_cleanup_queue(disk->queue); + blk_cleanup_queue(q); blk_mq_free_tag_set(&nbd->tag_set); disk->private_data = NULL; put_disk(disk);