When __begin_transaction_flags in metadata_open fails, dm_cache_metadata_close is called. dm_cache_metadata_close attempts to execute list_del(&cmd->list);, but the "cmd" object is not on any list yet, thus it crashes with NULL pointer dereference.
Fix this by initializing cmd->list after cmd is allocated. Signed-off-by: Mikulas Patocka <[email protected]> Assisted-by: Claude:claude-opus-5 Cc: [email protected] Fixes: c6b4fcbad044 ("dm: add cache target") --- drivers/md/dm-cache-metadata.c | 1 + 1 file changed, 1 insertion(+) Index: linux-2.6/drivers/md/dm-cache-metadata.c =================================================================== --- linux-2.6.orig/drivers/md/dm-cache-metadata.c +++ linux-2.6/drivers/md/dm-cache-metadata.c @@ -766,6 +766,7 @@ static struct dm_cache_metadata *metadat return ERR_PTR(-ENOMEM); } + INIT_LIST_HEAD(&cmd->list); cmd->version = metadata_version; refcount_set(&cmd->ref_count, 1); init_rwsem(&cmd->root_lock);
