From 829c4d21148a205eca864429e06530319e1f92d5 Mon Sep 17 00:00:00 2001 From: Mikulas Patocka Date: Fri, 9 Oct 2026 18:14:45 +0200 Subject: [PATCH] dm-snapshot: fix crash if dm_io_client_create fails If dm_io_client_create() fails, it stores error into the ps->io_client variable. The code would try to free it later with dm_io_client_destroy(ps->io_client), causing an invalid pointer dereference. Fix this by setting ps->io_client = NULL. Signed-off-by: Mikulas Patocka Assisted-by: Claude:claude-opus-5 Cc: stable@vger.kernel.org --- drivers/md/dm-snap-persistent.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/md/dm-snap-persistent.c b/drivers/md/dm-snap-persistent.c index e86d929b0e95..b587ee733056 100644 --- a/drivers/md/dm-snap-persistent.c +++ b/drivers/md/dm-snap-persistent.c @@ -325,8 +325,11 @@ static int read_header(struct pstore *ps, int *new_snapshot) } ps->io_client = dm_io_client_create(); - if (IS_ERR(ps->io_client)) - return PTR_ERR(ps->io_client); + if (IS_ERR(ps->io_client)) { + r = PTR_ERR(ps->io_client); + ps->io_client = NULL; + return r; + } r = alloc_area(ps); if (r)