nbd: fix nbd device deletion

This fixes a use after free bug, we shouldn't be doing disk->queue right
after we do del_gendisk(disk).  Save the queue and do the cleanup after
the del_gendisk.

Fixes: c6a4759ea0c9 ("nbd: add device refcounting")
cc: stable@vger.kernel.org
Signed-off-by: Josef Bacik <jbacik@fb.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index afbc202ca6fdad615e29bb9be1685aacc609ee45..9710a0c338b0a1ca83ca8da94038ad08a5e20b5a 100644 (file)
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -173,9 +173,12 @@ static const struct device_attribute pid_attr = {
 static void nbd_dev_remove(struct nbd_device *nbd)
 {
        struct gendisk *disk = nbd->disk;
+       struct request_queue *q;
+
        if (disk) {
+               q = disk->queue;
                del_gendisk(disk);
-               blk_cleanup_queue(disk->queue);
+               blk_cleanup_queue(q);
                blk_mq_free_tag_set(&nbd->tag_set);
                disk->private_data = NULL;
                put_disk(disk);