On Thu, Feb 03, 2022 at 09:15:53AM +0000, Stefan Hajnoczi wrote: > /* Make sure no work handler is accessing the device. */ > flush_work(&vblk->config_work); > > del_gendisk(vblk->disk); > blk_cleanup_disk(vblk->disk); > ^--- is virtblk_free_disk() called here? > blk_mq_free_tag_set(&vblk->tag_set); > ^--- use after free Yeah. We need to split up blk_cleanup_disk again for this into separate calls to blk_cleanup_queue and put_disk..
