drbd: use after free in drbd_create_device()
authorDan Carpenter <error27@gmail.com>
Tue, 15 Nov 2022 13:16:43 +0000 (16:16 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 26 Nov 2022 08:24:40 +0000 (09:24 +0100)
commit7d93417d596402ddd46bd76c721f205d09d0d025
treed83f02f425ad29cf60addbc0c8c051e729f41cb9
parentfc16a2c81a3eb1cbba8775f5bdc67856df903a7c
drbd: use after free in drbd_create_device()

[ Upstream commit a7a1598189228b5007369a9622ccdf587be0730f ]

The drbd_destroy_connection() frees the "connection" so use the _safe()
iterator to prevent a use after free.

Fixes: b6f85ef9538b ("drbd: Iterate over all connections")
Signed-off-by: Dan Carpenter <error27@gmail.com>
Reviewed-by: Christoph Böhmwalder <christoph.boehmwalder@linbit.com>
Link: https://lore.kernel.org/r/Y3Jd5iZRbNQ9w6gm@kili
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/block/drbd/drbd_main.c