Commit 07a756a49f4b ("Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet") moved the creation of the KVP and VSS transports after vmbus_open(). util_probe() still calls srv->util_deinit() when vmbus_open() or util_init_transport() fails, and hv_kvp_deinit() and hv_vss_deinit() destroy hvt unconditionally. On the first probe, or when hvutil_transport_init() has failed, hvt is NULL and hvutil_transport_destroy() dereferences it. After an unbind, hvt still points to the transport freed by util_remove(), so a failed re-probe frees it a second time. Skip the destroy when there is no transport and clear hvt after it. Found while reviewing a backport of commit 07a756a49f4b. Not reproduced at runtime. Fixes: 07a756a49f4b ("Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet") Cc: stable@vger.kernel.org Signed-off-by: Andrey Misiurov --- drivers/hv/hv_kvp.c | 5 ++++- drivers/hv/hv_snapshot.c | 5 ++++- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/drivers/hv/hv_kvp.c b/drivers/hv/hv_kvp.c index 336b278..813bec5 100644 --- a/drivers/hv/hv_kvp.c +++ b/drivers/hv/hv_kvp.c @@ -825,5 +825,8 @@ void hv_kvp_deinit(void) hv_kvp_cancel_work(); - hvutil_transport_destroy(hvt); + if (hvt) { + hvutil_transport_destroy(hvt); + hvt = NULL; + } } diff --git a/drivers/hv/hv_snapshot.c b/drivers/hv/hv_snapshot.c index 847dc69..a827cef 100644 --- a/drivers/hv/hv_snapshot.c +++ b/drivers/hv/hv_snapshot.c @@ -456,5 +456,8 @@ void hv_vss_deinit(void) hv_vss_cancel_work(); - hvutil_transport_destroy(hvt); + if (hvt) { + hvutil_transport_destroy(hvt); + hvt = NULL; + } } -- 2.43.7