Patch "xen/blkback: don't free be structure too early" has been added to the 4.4-stable tree

This is a note to let you know that I've just added the patch titled

xen/blkback: don't free be structure too early

to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
xen-blkback-don-t-free-be-structure-too-early.patch
and it can be found in the queue-4.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Juergen Gross <[email protected]>
Date: Thu, 18 May 2017 17:28:48 +0200
Subject: xen/blkback: don't free be structure too early
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

From: Juergen Gross <[email protected]>

commit 71df1d7ccad1c36f7321d6b3b48f2ea42681c363 upstream.

The be structure must not be freed when freeing the blkif structure isn't done. Otherwise a use-after-free of be when unmapping the ring used for communicating with the frontend will occur in case of a late call of xenblk_disconnect() (e.g. due to an I/O still active when trying to disconnect).

---
 drivers/block/xen-blkback/xenbus.c |    7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

@@ -266,9 +266,10 @@ static int xen_blkif_disconnect(struct x
 
 static void xen_blkif_free(struct xen_blkif *blkif)
 {
-
-	xen_blkif_disconnect(blkif);
+	WARN_ON(xen_blkif_disconnect(blkif));
 	xen_vbd_free(&blkif->vbd);
+	kfree(blkif->be->mode);
+	kfree(blkif->be);
 
 	/* Make sure everything is drained before shutting down */
 	BUG_ON(blkif->persistent_gnt_c != 0);

@@ -445,8 +446,6 @@ static int xen_blkbk_remove(struct xenbu
 		xen_blkif_put(be->blkif);
 	}
 
-	kfree(be->mode);
-	kfree(be);
 	return 0;
 }
 

Patches currently in stable-queue which might be from [email protected] are

queue-4.4/xen-blkback-don-t-free-be-structure-too-early.patch queue-4.4/xen-blkback-don-t-use-xen_blkif_get-in-xen-blkback-kthread.patch