nbd: fix order of cleaning up the queue and freeing the tagset

We must release the queue before freeing the tagset.

Fixes: 4af5f2e03013 ("nbd: use blk_mq_alloc_disk and blk_cleanup_disk")
Reported-and-tested-by: syzbot+9ca43ff47167c0ee3466@syzkaller.appspotmail.com
Signed-off-by: Wang Qing <wangqing@vivo.com>
Signed-off-by: Guoqing Jiang <jiangguoqing@kylinos.cn>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Link: https://lore.kernel.org/r/20210706040016.1360412-1-guoqing.jiang@linux.dev
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index b7d663736d35b3f3796cd4de5859affbb81540c3..c38317979f74ec42a92885d7f963a49526bd8637 100644 (file)
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -239,8 +239,8 @@ static void nbd_dev_remove(struct nbd_device *nbd)
 
        if (disk) {
                del_gendisk(disk);
-               blk_mq_free_tag_set(&nbd->tag_set);
                blk_cleanup_disk(disk);
+               blk_mq_free_tag_set(&nbd->tag_set);
        }
 
        /*