If dm_io_client_create() fails, it stores error into the ps->io_client variable. The code would try to free it later with dm_io_client_destroy(ps->io_client), causing an invalid pointer dereference. Fix this by setting ps->io_client = NULL.
Signed-off-by: Mikulas Patocka <[email protected]> Assisted-by: Claude:claude-opus-5 Cc: [email protected] --- drivers/md/dm-snap-persistent.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) Index: linux-2.6/drivers/md/dm-snap-persistent.c =================================================================== --- linux-2.6.orig/drivers/md/dm-snap-persistent.c +++ linux-2.6/drivers/md/dm-snap-persistent.c @@ -325,8 +325,11 @@ static int read_header(struct pstore *ps } ps->io_client = dm_io_client_create(); - if (IS_ERR(ps->io_client)) - return PTR_ERR(ps->io_client); + if (IS_ERR(ps->io_client)) { + r = PTR_ERR(ps->io_client); + ps->io_client = NULL; + return r; + } r = alloc_area(ps); if (r)
