blkg_conf_open_bdev() holds rq_qos_mutex while checking whether the disk is still live. On the dead-disk error path, it drops the bdev reference before unlocking the mutex. Once that reference is dropped, a concurrent put_disk() can release the remaining device reference and free the bdev. The subsequent mutex_unlock() then dereferences bdev->bd_queue from the freed object. Unlock rq_qos_mutex while the local bdev reference still pins the object. Drop the reference only after the final bdev access. Fixes: a13bd91be223 ("block/rq_qos: protect rq_qos apis with a new lock") Cc: stable@vger.kernel.org Signed-off-by: Shuangpeng Bai --- block/blk-cgroup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c index d9676126c5b5..8628ab6adfa9 100644 --- a/block/blk-cgroup.c +++ b/block/blk-cgroup.c @@ -799,8 +799,8 @@ int blkg_conf_open_bdev(struct blkg_conf_ctx *ctx) mutex_lock(&bdev->bd_queue->rq_qos_mutex); if (!disk_live(bdev->bd_disk)) { - blkdev_put_no_open(bdev); mutex_unlock(&bdev->bd_queue->rq_qos_mutex); + blkdev_put_no_open(bdev); return -ENODEV; } -- 2.43.0