[PATCH] rnbd-srv: Fix sess_dev use-after-free in process_msg_close()

[Wentao Liang]

process_msg_close() drops the device reference with rnbd_put_sess_dev()
before using sess_dev again in rnbd_srv_destroy_dev_session_sysfs().
If that put drops the last kref, e.g. when the device is concurrently
being torn down through rnbd_srv_sess_dev_force_close(), the waiter in
rnbd_destroy_sess_dev() is woken up and frees sess_dev, so the
subsequent rnbd_srv_destroy_dev_session_sysfs() call operates on freed
memory.

Move the rnbd_put_sess_dev() call after the sysfs teardown so it is the
last access to sess_dev.

Fixes: 2de6c8de192b ("block/rnbd: server: main functionality")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
---
 drivers/block/rnbd/rnbd-srv.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/block/rnbd/rnbd-srv.c b/drivers/block/rnbd/rnbd-srv.c
index 10e8c438bb43..2ebc2eac384f 100644
--- a/drivers/block/rnbd/rnbd-srv.c
+++ b/drivers/block/rnbd/rnbd-srv.c
@@ -361,10 +361,10 @@ static void process_msg_close(struct rnbd_srv_session *srv_sess,
 	if (IS_ERR(sess_dev))
 		return;
 
-	rnbd_put_sess_dev(sess_dev);
 	mutex_lock(&srv_sess->lock);
 	rnbd_srv_destroy_dev_session_sysfs(sess_dev);
 	mutex_unlock(&srv_sess->lock);
+	rnbd_put_sess_dev(sess_dev);
 }
 
 static int process_msg_open(struct rnbd_srv_session *srv_sess,
-- 
2.34.1