CVE-2026-64509: rust: block: fix GenDisk cleanup paths

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

rust: block: fix GenDisk cleanup paths

GenDiskBuilder::build() still has fallible work after
__blk_mq_alloc_disk(), but its error path only recovers the
foreign queue data. That leaks the temporary gendisk and
request_queue until later teardown. If the caller moved the last
Arc<TagSet<T>> into build(), the leaked queue can retain blk-mq
state after the tag set is dropped.

Fix the pre-registration failure path by dropping the temporary
gendisk reference with put_disk() before recovering queue_data,
so disk_release() can tear down the owned queue.

Also pair GenDisk::drop() with put_disk() after del_gendisk().
Once a Rust GenDisk has been added with device_add_disk(),
del_gendisk() only unregisters it; the final gendisk reference
still has to be dropped to complete the release path.

The Linux kernel CVE team has assigned CVE-2026-64509 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.11 with commit 3253aba3408aa4eb2e4e09365eede3e63ef7536b and fixed in 6.12.97 with commit d1dcaa5229a63a6b6df7e0f673fe576cf3d6e8cb
	Issue introduced in 6.11 with commit 3253aba3408aa4eb2e4e09365eede3e63ef7536b and fixed in 6.18.39 with commit e7636f26f77070a529c26d65afd217514ce85ce4
	Issue introduced in 6.11 with commit 3253aba3408aa4eb2e4e09365eede3e63ef7536b and fixed in 7.1.4 with commit 6822a2685b4da9a87efd1fce4b042678a31ff734
	Issue introduced in 6.11 with commit 3253aba3408aa4eb2e4e09365eede3e63ef7536b and fixed in 7.2-rc1 with commit 2957771379fa335103a4b539db57bb2271e12142

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64509
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	rust/kernel/block/mq/gen_disk.rs


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/d1dcaa5229a63a6b6df7e0f673fe576cf3d6e8cb
	https://git.kernel.org/stable/c/e7636f26f77070a529c26d65afd217514ce85ce4
	https://git.kernel.org/stable/c/6822a2685b4da9a87efd1fce4b042678a31ff734
	https://git.kernel.org/stable/c/2957771379fa335103a4b539db57bb2271e12142