6.11-stable review patch. If anyone has any objections, please let me know. ------------------ From: Mikulas Patocka <mpatocka@xxxxxxxxxx> commit fed13a5478680614ba97fc87e71f16e2e197912e upstream. If blk_alloc_disk fails, the variable md->disk is set to an error value. cleanup_mapped_device will see that md->disk is non-NULL and it will attempt to access it, causing a crash on this statement "md->disk->private_data = NULL;". Signed-off-by: Mikulas Patocka <mpatocka@xxxxxxxxxx> Reported-by: Chenyuan Yang <chenyuan0y@xxxxxxxxx> Closes: https://marc.info/?l=dm-devel&m=172824125004329&w=2 Cc: stable@xxxxxxxxxxxxxxx Reviewed-by: Nitesh Shetty <nj.shetty@xxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- drivers/md/dm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/drivers/md/dm.c +++ b/drivers/md/dm.c @@ -2290,8 +2290,10 @@ static struct mapped_device *alloc_dev(i * override accordingly. */ md->disk = blk_alloc_disk(NULL, md->numa_node_id); - if (IS_ERR(md->disk)) + if (IS_ERR(md->disk)) { + md->disk = NULL; goto bad; + } md->queue = md->disk->queue; init_waitqueue_head(&md->wait);
