On Fri, 2018-04-13 at 12:21 -0400, Josef Bacik wrote: > On Fri, Apr 13, 2018 at 04:16:18PM +0000, Bart Van Assche wrote: > > On Fri, 2018-04-13 at 12:03 -0400, Josef Bacik wrote: > > > This fixes a use after free bug, we need to do the del_gendisk after we > > > cleanup the queue on the device. > > > > Hello Josef, > > > > Which use-after-free bug does this patch fix? Are you aware that most block > > drivers call blk_cleanup_queue() before calling del_gendisk()? Why do you > > think that the nbd driver should use the opposite order? > > I'm confused, that's what this patch does. Before I had del_gendisk() first and > then the blk_cleanup_queue(), which was bugging out when I was testing stuff > with a null pointer deref whenever I rmmod'ed the nbd. Swapping it to the way > everybody else did it fixed the problem. Thanks, Hello Josef, Oops, I swapped "blk_cleanup_queue()" and "del_gendisk()" in my e-mail. Can you share the call stack of the NULL pointer deref and also the translation of the crash address into a source code line? Thanks, Bart.
