[PATCH] block: clear ia_ranges on sysfs registration failure

disk_register_independent_access_ranges() clears disk->ia_ranges when
creating the top-level kobject fails. However, if adding one of the range
kobjects fails, the cleanup drops the final reference to iars and frees it
while disk->ia_ranges still points at it.

A concurrent disk revalidation can wait for q->sysfs_lock and then call
disk_unregister_independent_access_ranges(), which dereferences the stale
pointer after registration releases the mutex.

Clear disk->ia_ranges before dropping the kobject references on the child
registration error path, matching the top-level error handling.

Fixes: a2247f19ee1c ("block: Add independent access ranges support")
Cc: [email protected]
Signed-off-by: Shuangpeng Bai <[email protected]>
---
 block/blk-ia-ranges.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/block/blk-ia-ranges.c b/block/blk-ia-ranges.c
index 7be8b58893c9..2430e475a8e7 100644
--- a/block/blk-ia-ranges.c
+++ b/block/blk-ia-ranges.c
@@ -135,6 +135,7 @@ int disk_register_independent_access_ranges(struct gendisk *disk)
 					   &blk_ia_range_ktype, &iars->kobj,
 					   "%d", i);
 		if (ret) {
+			disk->ia_ranges = NULL;
 			while (--i >= 0)
 				kobject_del(&iars->ia_range[i].kobj);
 			kobject_del(&iars->kobj);
-- 
2.43.0