Call free_opal_dev from scsi_disk_release as the opal_dev field is access from the ioctl handler, which isn't synchronized vs sd_release and thus can be accesses during or after sd_release was called. Signed-off-by: Christoph Hellwig <hch@xxxxxx> --- drivers/scsi/sd.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c index 7bfebf5b2832d..346b8d62de7d1 100644 --- a/drivers/scsi/sd.c +++ b/drivers/scsi/sd.c @@ -3632,8 +3632,6 @@ static int sd_remove(struct device *dev) del_gendisk(sdkp->disk); sd_shutdown(dev); - free_opal_dev(sdkp->opal_dev); - mutex_lock(&sd_ref_mutex); dev_set_drvdata(dev, NULL); put_device(&sdkp->disk_dev); @@ -3675,6 +3673,7 @@ static void scsi_disk_release(struct device *dev) sd_zbc_release_disk(sdkp); put_device(&sdkp->device->sdev_gendev); + free_opal_dev(sdkp->opal_dev); kfree(sdkp); } -- 2.30.2
