blkg_conf_open_bdev() holds rq_qos_mutex while checking whether the disk is
still live. On the dead-disk error path, it drops the bdev reference before
unlocking the mutex.

Once that reference is dropped, a concurrent put_disk() can release the
remaining device reference and free the bdev. The subsequent mutex_unlock()
then dereferences bdev->bd_queue from the freed object.

Unlock rq_qos_mutex while the local bdev reference still pins the object.
Drop the reference only after the final bdev access.

Fixes: a13bd91be223 ("block/rq_qos: protect rq_qos apis with a new lock")
Cc: stable@vger.kernel.org
Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
---
 block/blk-cgroup.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
index d9676126c5b5..8628ab6adfa9 100644
--- a/block/blk-cgroup.c
+++ b/block/blk-cgroup.c
@@ -799,8 +799,8 @@ int blkg_conf_open_bdev(struct blkg_conf_ctx *ctx)
 
 	mutex_lock(&bdev->bd_queue->rq_qos_mutex);
 	if (!disk_live(bdev->bd_disk)) {
-		blkdev_put_no_open(bdev);
 		mutex_unlock(&bdev->bd_queue->rq_qos_mutex);
+		blkdev_put_no_open(bdev);
 		return -ENODEV;
 	}
 
-- 
2.43.0