[Devel] [PATCH rh7 5/8] nbd: fix nbd device deletion

[Andrey Ryabinin]

From: Josef Bacik <jbacik at fb.com>

This fixes a use after free bug, we shouldn't be doing disk->queue right
after we do del_gendisk(disk).  Save the queue and do the cleanup after
the del_gendisk.

Fixes: c6a4759ea0c9 ("nbd: add device refcounting")
cc: stable at vger.kernel.org
Signed-off-by: Josef Bacik <jbacik at fb.com>
Signed-off-by: Jens Axboe <axboe at kernel.dk>

https://jira.sw.ru/browse/PSBM-99102
(cherry picked from commit 8364da4751cf22201d74933d5e634176f44ed407)
Signed-off-by: Andrey Ryabinin <aryabinin at virtuozzo.com>
---
 drivers/block/nbd.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index 9e0450300cc1..ea5880077933 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -154,9 +154,12 @@ static struct device_attribute pid_attr = {
 static void nbd_dev_remove(struct nbd_device *nbd)
 {
 	struct gendisk *disk = nbd->disk;
+	struct request_queue *q;
+
 	if (disk) {
+		q = disk->queue;
 		del_gendisk(disk);
-		blk_cleanup_queue(disk->queue);
+		blk_cleanup_queue(q);
 		blk_mq_free_tag_set(&nbd->tag_set);
 		put_disk(disk);
 	}
-- 
2.23.0