[Devel] [PATCH RHEL7 COMMIT] ms/nbd: fix nbd device deletion

[Konstantin Khorenko]

The commit is pushed to "branch-rh7-3.10.0-1062.4.1.vz7.115.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-1062.4.1.vz7.115.7
------>
commit 1c66b6a20827805f42d90f7c1e07b185b32b94ba
Author: Josef Bacik <jbacik at fb.com>
Date:   Tue Nov 5 11:06:16 2019 +0300

    ms/nbd: fix nbd device deletion
    
    This fixes a use after free bug, we shouldn't be doing disk->queue right
    after we do del_gendisk(disk).  Save the queue and do the cleanup after
    the del_gendisk.
    
    Fixes: c6a4759ea0c9 ("nbd: add device refcounting")
    cc: stable at vger.kernel.org
    Signed-off-by: Josef Bacik <jbacik at fb.com>
    Signed-off-by: Jens Axboe <axboe at kernel.dk>
    
    https://jira.sw.ru/browse/PSBM-99102
    (cherry picked from commit 8364da4751cf22201d74933d5e634176f44ed407)
    Signed-off-by: Andrey Ryabinin <aryabinin at virtuozzo.com>
---
 drivers/block/nbd.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index 9e0450300cc1..ea5880077933 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -154,9 +154,12 @@ static struct device_attribute pid_attr = {
 static void nbd_dev_remove(struct nbd_device *nbd)
 {
 	struct gendisk *disk = nbd->disk;
+	struct request_queue *q;
+
 	if (disk) {
+		q = disk->queue;
 		del_gendisk(disk);
-		blk_cleanup_queue(disk->queue);
+		blk_cleanup_queue(q);
 		blk_mq_free_tag_set(&nbd->tag_set);
 		put_disk(disk);
 	}