Li Lingfeng 327462725b nbd: fix uaf in nbd_open ... Commit 4af5f2e030 ("nbd: use blk_mq_alloc_disk and blk_cleanup_disk") cleans up disk by blk_cleanup_disk() and it won't set disk->private_data as NULL as before. UAF may be triggered in nbd_open() if someone tries to open nbd device right after nbd_put() since nbd has been free in nbd_dev_remove(). Fix this by implementing ->free_disk and free private data in it. Fixes: 4af5f2e030 ("nbd: use blk_mq_alloc_disk and blk_cleanup_disk") Signed-off-by: Li Lingfeng <lilingfeng3@huawei.com> Reviewed-by: Josef Bacik <josef@toxicpanda.com> Link: https://lore.kernel.org/r/20231107103435.2074904-1-lilingfeng@huaweicloud.com Signed-off-by: Jens Axboe <axboe@kernel.dk>		2023-11-07 08:14:57 -07:00
..
aoe	…
drbd	hardening updates for v6.7-rc1	2023-10-30 19:09:55 -10:00
mtip32xx	…
null_blk	…
rnbd	rnbd-srv: Convert to use bdev_open_by_path()	2023-10-28 13:29:17 +02:00
xen-blkback	xen/blkback: Convert to bdev_open_by_dev()	2023-10-28 13:29:17 +02:00
zram	zram: Convert to use bdev_open_by_dev()	2023-10-28 13:29:17 +02:00
Kconfig	…
Makefile	…
amiflop.c	…
ataflop.c	block: move bdev_mark_dead out of disk_check_media_change	2023-10-28 13:29:23 +02:00
brd.c	…
floppy.c	block: move bdev_mark_dead out of disk_check_media_change	2023-10-28 13:29:23 +02:00
loop.c	…
n64cart.c	…
nbd.c	nbd: fix uaf in nbd_open	2023-11-07 08:14:57 -07:00
pktcdvd.c	pktcdvd: Convert to bdev_open_by_dev()	2023-10-28 13:29:17 +02:00
ps3disk.c	…
ps3vram.c	…
rbd.c	…
rbd_types.h	…
sunvdc.c	…
swim.c	…
swim3.c	…
swim_asm.S	…
ublk_drv.c	block: ublk_drv: Remove unused function	2023-10-19 05:24:02 -06:00
virtio_blk.c	vhost,virtio,vdpa: features, fixes, cleanups	2023-11-05 09:02:32 -10:00
xen-blkfront.c	…
z2ram.c	…