On Thu, 31 Jul 2025 20:07:45 +0900, Shin'ichiro Kawasaki wrote:
> When a zoned loop device, or zloop device, is removed, KASAN enabled
> kernel reports "BUG KASAN use-after-free" in blk_mq_free_tag_set(). The
> BUG happens because zloop_ctl_remove() calls put_disk(), which invokes
> zloop_free_disk(). The zloop_free_disk() frees the memory allocated for
> the zlo pointer. However, after the memory is freed, zloop_ctl_remove()
> calls blk_mq_free_tag_set(&zlo->tag_set), which accesses the freed zlo.
> Hence the KASAN use-after-free.
>
> [...]
Applied, thanks!
[1/1] zloop: fix KASAN use-after-free of tag set
commit: 765761851d89c772f482494d452e266795460278
Best regards,
--
Jens Axboe
