[PATCH] block: clear ia_ranges on sysfs registration failure

[PATCH] block: clear ia_ranges on sysfs registration failure

[Shuangpeng Bai]

disk_register_independent_access_ranges() clears disk->ia_ranges when
creating the top-level kobject fails. However, if adding one of the range
kobjects fails, the cleanup drops the final reference to iars and frees it
while disk->ia_ranges still points at it.

A concurrent disk revalidation can wait for q->sysfs_lock and then call
disk_unregister_independent_access_ranges(), which dereferences the stale
pointer after registration releases the mutex.

Clear disk->ia_ranges before dropping the kobject references on the child
registration error path, matching the top-level error handling.

Fixes: a2247f19ee1c ("block: Add independent access ranges support")
Cc: stable@vger.kernel.org
Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
---
 block/blk-ia-ranges.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/block/blk-ia-ranges.c b/block/blk-ia-ranges.c
index 7be8b58893c9..2430e475a8e7 100644
--- a/block/blk-ia-ranges.c
+++ b/block/blk-ia-ranges.c
@@ -135,6 +135,7 @@ int disk_register_independent_access_ranges(struct gendisk *disk)
 					   &blk_ia_range_ktype, &iars->kobj,
 					   "%d", i);
 		if (ret) {
+			disk->ia_ranges = NULL;
 			while (--i >= 0)
 				kobject_del(&iars->ia_range[i].kobj);
 			kobject_del(&iars->kobj);
-- 
2.43.0

Re: [PATCH] block: clear ia_ranges on sysfs registration failure

[Christoph Hellwig]

Looks good:

Reviewed-by: Christoph Hellwig <hch@lst.de>

On Fri, Aug 14, 2026 at 06:04:48PM -0400, Shuangpeng Bai wrote:
> disk_register_independent_access_ranges() clears disk->ia_ranges when
> creating the top-level kobject fails. However, if adding one of the range
> kobjects fails, the cleanup drops the final reference to iars and frees it
> while disk->ia_ranges still points at it.
> 
> A concurrent disk revalidation can wait for q->sysfs_lock and then call
> disk_unregister_independent_access_ranges(), which dereferences the stale
> pointer after registration releases the mutex.
> 
> Clear disk->ia_ranges before dropping the kobject references on the child
> registration error path, matching the top-level error handling.
> 
> Fixes: a2247f19ee1c ("block: Add independent access ranges support")
> Cc: stable@vger.kernel.org
> Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
> ---
>  block/blk-ia-ranges.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/block/blk-ia-ranges.c b/block/blk-ia-ranges.c
> index 7be8b58893c9..2430e475a8e7 100644
> --- a/block/blk-ia-ranges.c
> +++ b/block/blk-ia-ranges.c
> @@ -135,6 +135,7 @@ int disk_register_independent_access_ranges(struct gendisk *disk)
>  					   &blk_ia_range_ktype, &iars->kobj,
>  					   "%d", i);
>  		if (ret) {
> +			disk->ia_ranges = NULL;
>  			while (--i >= 0)
>  				kobject_del(&iars->ia_range[i].kobj);
>  			kobject_del(&iars->kobj);
> -- 
> 2.43.0
> 
> 
---end quoted text---