Ming Lei 75cd4005da ublk: detach gendisk from ublk device if add_disk() fails ...

Inside ublk_abort_requests(), gendisk is grabbed for aborting all
inflight requests. And ublk_abort_requests() is called when exiting
the uring context or handling timeout.

If add_disk() fails, the gendisk may have been freed when calling
ublk_abort_requests(), so use-after-free can be caused when getting
disk's reference in ublk_abort_requests().

Fixes the bug by detaching gendisk from ublk device if add_disk() fails.

Fixes: bd23f6c2c2d0 ("ublk: quiesce request queue when aborting queue")
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Link: https://lore.kernel.org/r/20241225110640.351531-1-ming.lei@redhat.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>

2024-12-26 06:42:55 -07:00

..

aoe

block-6.12-20241004

2024-10-04 10:43:44 -07:00

drbd

block-6.12-20241018

2024-10-18 15:53:00 -07:00

mtip32xx

mtip32xx: Replace deprecated PCI functions

2024-11-06 07:54:50 -07:00

null_blk

block: add a rq_list type

2024-11-13 12:04:58 -07:00

rnbd

block/rnbd-srv: Add sanity check and remove redundant assignment

2024-08-28 08:50:35 -06:00

xen-blkback

xen/blkback: add missing MODULE_DESCRIPTION() macro

2024-07-10 00:21:18 -06:00

zram

zram: fix NULL pointer in comp_algorithm_show()

2024-11-14 22:49:19 -08:00

amiflop.c

Merge branch 'for-6.11/block-limits' into for-6.11/block

2024-06-19 08:14:49 -06:00

ataflop.c

Merge branch 'for-6.11/block-limits' into for-6.11/block

2024-06-19 08:14:49 -06:00

brd.c

brd: decrease the number of allocated pages which discarded

2024-11-29 08:43:52 -07:00

floppy.c

floppy: add missing MODULE_DESCRIPTION() macro

2024-07-10 00:22:03 -06:00

Kconfig

reiserfs: The last commit

2024-10-21 16:29:38 +02:00

loop.c

loop: Fix ABBA locking race

2024-11-19 07:54:56 -07:00

Makefile

rust: block: add rnull, Rust null_blk implementation

2024-06-14 07:45:04 -06:00

n64cart.c

block: move the nonrot flag to queue_limits

2024-06-19 07:58:28 -06:00

nbd.c

nbd: correct the maximum value for discard sectors

2024-09-06 08:31:40 -06:00

pktcdvd.c

move asm/unaligned.h to linux/unaligned.h

2024-10-02 17:23:23 -04:00

ps3disk.c

block: move the nonrot flag to queue_limits

2024-06-19 07:58:28 -06:00

ps3vram.c

block: pass a queue_limits argument to blk_alloc_disk

2024-02-19 16:58:23 -07:00

rbd_types.h

libceph, rbd: replace zero-length array with flexible-array

2020-06-01 13:22:53 +02:00

rbd.c

rbd: unfreeze queue after marking disk as dead

2024-11-07 16:27:22 -07:00

rnull.rs

block: rnull: add missing MODULE_DESCRIPTION

2024-12-03 06:34:11 -07:00

sunvdc.c

block: move the nonrot flag to queue_limits

2024-06-19 07:58:28 -06:00

swim3.c

block: move the nonrot flag to queue_limits

2024-06-19 07:58:28 -06:00

swim_asm.S

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152

2019-05-30 11:26:32 -07:00

swim.c

Get rid of 'remove_new' relic from platform driver struct

2024-12-01 15:12:43 -08:00

ublk_drv.c

ublk: detach gendisk from ublk device if add_disk() fails

2024-12-26 06:42:55 -07:00

virtio_blk.c

virtio-blk: don't keep queue frozen during system suspend

2024-12-05 10:00:20 -07:00

xen-blkfront.c

xen-blkfront: fix sector_size propagation to the block layer

2024-07-02 08:58:12 -06:00

z2ram.c

z2ram: add missing MODULE_DESCRIPTION() macro

2024-06-19 07:54:00 -06:00