Re: [PATCH] nbd: defer config unlock in nbd_genl_connect
On Mon, 10 Nov 2025 20:49:20 +0800, Zheng Qixing wrote:
> There is one use-after-free warning when running NBD_CMD_CONNECT and
> NBD_CLEAR_SOCK:
>
> nbd_genl_connect
> nbd_alloc_and_init_config // config_refs=1
> nbd_start_device // config_refs=2
> set NBD_RT_HAS_CONFIG_REF open nbd // config_refs=3
> recv_work done // config_refs=2
> NBD_CLEAR_SOCK // config_refs=1
> close nbd // config_refs=0
> refcount_inc -> uaf
>
> [...]
Applied, thanks!
[1/1] nbd: defer config unlock in nbd_genl_connect
commit: 1649714b930f9ea6233ce0810ba885999da3b5d4
Best regards,
--
Jens Axboe
Reply to: