linux/drivers/block
Juergen Gross afaee3ef51 xen/blkback: don't free be structure too early
commit 71df1d7cca upstream.

The be structure must not be freed when freeing the blkif structure
isn't done. Otherwise a use-after-free of be when unmapping the ring
used for communicating with the frontend will occur in case of a
late call of xenblk_disconnect() (e.g. due to an I/O still active
when trying to disconnect).

Signed-off-by: Juergen Gross <jgross@suse.com>
Tested-by: Steven Haigh <netwiz@crc.id.au>
Acked-by: Roger Pau Monné <roger.pau@citrix.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2017-07-05 14:40:20 +02:00
..
aoe aoe: fix crash in page count manipulation 2016-11-12 08:27:07 -07:00
drbd drbd: Fix kernel_sendmsg() usage - potential NULL deref 2016-11-09 17:08:32 -07:00
mtip32xx blk-mq: remove ->map_queue 2016-09-15 08:42:03 -06:00
paride paride: make 'verbose' parameter an 'int' again 2016-03-15 16:55:16 -07:00
rsxx block: convert to device_add_disk() 2016-06-27 12:26:08 -07:00
xen-blkback xen/blkback: don't free be structure too early 2017-07-05 14:40:20 +02:00
zram zram: do not use copy_page with non-page aligned address 2017-04-21 09:31:22 +02:00
amiflop.c block: drop owner assignment from platform_drivers 2014-10-20 16:20:18 +02:00
ataflop.c Merge branch 'for-3.16/core' of git://git.kernel.dk/linux-block into next 2014-06-02 09:29:34 -07:00
brd.c block/mm: make bdev_ops->rw_page() take a bool for read/write 2016-08-07 14:41:02 -06:00
cciss.c block: convert to device_add_disk() 2016-06-27 12:26:08 -07:00
cciss.h cciss: Adds simple mode functionality 2011-08-08 11:40:15 +02:00
cciss_cmd.h cciss: use new doorbell-bit-5 reset method 2011-05-06 08:23:55 -06:00
cciss_scsi.c scsi: Do not set cmd_per_lun to 1 in the host template 2015-05-31 18:06:28 -07:00
cciss_scsi.h cciss: add cciss_tape_cmds module paramter 2011-05-06 08:23:59 -06:00
cryptoloop.c block: cryptoloop - Use new skcipher interface 2016-01-27 20:35:43 +08:00
DAC960.c block: DAC960: print a hex number after a 0x prefix 2016-10-27 18:43:43 -07:00
DAC960.h Fix DAC960 driver on machines which don't support 64-bit DMA 2007-09-11 17:21:19 -07:00
floppy.c Revert "floppy: refactor open() flags handling" 2016-08-25 08:56:51 -06:00
hd.c block: hd: remove deprecated IRQF_DISABLED 2014-10-01 08:16:07 -06:00
Kconfig cpqarray: remove it from the kernel 2016-03-14 09:06:01 -06:00
loop.c loop: fix LO_FLAGS_PARTSCAN hang 2017-03-12 06:41:45 +01:00
loop.h block: loop: support DIO & AIO 2015-09-23 11:01:16 -06:00
Makefile drivers:block: cpqarray clean up 2016-03-15 15:59:47 -07:00
mg_disk.c mg_disk: fix error path in mg_probe() 2016-06-28 11:01:27 -06:00
nbd.c nbd: fix 64-bit division 2017-04-21 09:31:23 +02:00
null_blk.c Merge branch 'for-4.9/block-irq' of git://git.kernel.dk/linux-block 2016-10-09 17:29:33 -07:00
osdblk.c block, drivers: add REQ_OP_FLUSH operation 2016-06-07 13:41:38 -06:00
pktcdvd.c block: rename bio bi_rw to bi_opf 2016-08-07 14:41:02 -06:00
ps3disk.c block: convert to device_add_disk() 2016-06-27 12:26:08 -07:00
ps3vram.c block: convert to device_add_disk() 2016-06-27 12:26:08 -07:00
rbd.c rbd: don't retry watch reregistration if header object is gone 2016-10-15 23:22:09 +02:00
rbd_types.h rbd: support for exclusive-lock feature 2016-08-24 23:49:16 +02:00
skd_main.c block: convert to device_add_disk() 2016-06-27 12:26:08 -07:00
skd_s1120.h skd: fix formatting in skd_s1120.h 2013-11-08 09:10:30 -07:00
smart1,2.h fix typos 'comamnd' -> 'command' in comments 2011-02-02 11:31:21 +01:00
sunvdc.c block: convert to device_add_disk() 2016-06-27 12:26:08 -07:00
swim.c block: drop owner assignment from platform_drivers 2014-10-20 16:20:18 +02:00
swim3.c powerpc: Move Power Macintosh drivers to generic byteswappers 2015-03-23 14:29:40 +11:00
swim_asm.S m68k: mac - Add SWIM floppy support 2009-03-26 21:15:27 +01:00
sx8.c sx8: use real time for the command seconds 2015-12-23 08:42:59 -07:00
umem.c block: rename bio bi_rw to bi_opf 2016-08-07 14:41:02 -06:00
umem.h drivers/block/umem: trim trailing whitespace 2007-10-10 09:25:59 +02:00
virtio_blk.c virtio_blk: avoid DMA to stack for the sense buffer 2017-01-19 20:18:03 +01:00
xen-blkfront.c blk-mq: remove ->map_queue 2016-09-15 08:42:03 -06:00
xsysace.c block: systemace: Remove .owner field for driver 2014-08-21 20:37:54 -05:00
z2ram.c block: remove struct request buffer member 2014-04-15 14:03:02 -06:00