disk_register_independent_access_ranges() clears disk->ia_ranges when creating the top-level kobject fails. However, if adding one of the range kobjects fails, the cleanup drops the final reference to iars and frees it while disk->ia_ranges still points at it. A concurrent disk revalidation can wait for q->sysfs_lock and then call disk_unregister_independent_access_ranges(), which dereferences the stale pointer after registration releases the mutex. Clear disk->ia_ranges before dropping the kobject references on the child registration error path, matching the top-level error handling. Fixes: a2247f19ee1c ("block: Add independent access ranges support") Cc: stable@vger.kernel.org Signed-off-by: Shuangpeng Bai --- block/blk-ia-ranges.c | 1 + 1 file changed, 1 insertion(+) diff --git a/block/blk-ia-ranges.c b/block/blk-ia-ranges.c index 7be8b58893c9..2430e475a8e7 100644 --- a/block/blk-ia-ranges.c +++ b/block/blk-ia-ranges.c @@ -135,6 +135,7 @@ int disk_register_independent_access_ranges(struct gendisk *disk) &blk_ia_range_ktype, &iars->kobj, "%d", i); if (ret) { + disk->ia_ranges = NULL; while (--i >= 0) kobject_del(&iars->ia_range[i].kobj); kobject_del(&iars->kobj); -- 2.43.0