[PATCH] dm-pcache: fix use-after-free during cache replay

[PATCH] dm-pcache: fix use-after-free during cache replay

[Shuangpeng Bai]

kset_replay() drops the last reference to a stale cache key before
using key->cache_pos to acquire a reference to its cache segment. This
can dereference the freed key.

Segment references account for key records that have not yet been
consumed by key-log garbage collection. A reference is acquired for
every successfully recorded key, and the GC path drops one for every
record, including records whose segment generation has become stale.
Replay therefore has to restore the segment reference before deciding
whether the decoded key should be inserted into the request-key tree.

Move cache_seg_get() before the generation check. This preserves the
get/put accounting for stale records while ensuring that the key is not
accessed after cache_key_put().

Fixes: 1d57628ff95b ("dm-pcache: add persistent cache target in device-mapper")

Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
---
 drivers/md/dm-pcache/cache_key.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/md/dm-pcache/cache_key.c b/drivers/md/dm-pcache/cache_key.c
index e068e878231b..b37d899f2d3c 100644
--- a/drivers/md/dm-pcache/cache_key.c
+++ b/drivers/md/dm-pcache/cache_key.c
@@ -729,6 +729,7 @@ static int kset_replay(struct pcache_cache *cache, struct pcache_cache_kset_onme
 		}
 
 		__set_bit(key->cache_pos.cache_seg->cache_seg_id, cache->seg_map);
+		cache_seg_get(key->cache_pos.cache_seg);
 
 		/* Check if the segment generation is valid for insertion. */
 		if (key->seg_gen < key->cache_pos.cache_seg->gen) {
@@ -739,8 +740,6 @@ static int kset_replay(struct pcache_cache *cache, struct pcache_cache_kset_onme
 			cache_key_insert(&cache->req_key_tree, key, true);
 			spin_unlock(&cache_subtree->tree_lock);
 		}
-
-		cache_seg_get(key->cache_pos.cache_seg);
 	}
 
 	return 0;
-- 
2.43.0

Re: [PATCH] dm-pcache: fix use-after-free during cache replay

[Mikulas Patocka]

Hi

This patch doesn't apply to the current device mapper working tree because 
another patch was already committed there: c2e894eac398 ("dm-pcache: fix 
use-after-free and invalid seg operations in kset_replay()").

Please, download the current device mapper repository from 
git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm.git

Checkout the branch for-next.

Verify that the bug is still present there.

If yes, send the patch against the "for-next" branch.

Mikulas



On Wed, 5 Aug 2026, Shuangpeng Bai wrote:

> kset_replay() drops the last reference to a stale cache key before
> using key->cache_pos to acquire a reference to its cache segment. This
> can dereference the freed key.
> 
> Segment references account for key records that have not yet been
> consumed by key-log garbage collection. A reference is acquired for
> every successfully recorded key, and the GC path drops one for every
> record, including records whose segment generation has become stale.
> Replay therefore has to restore the segment reference before deciding
> whether the decoded key should be inserted into the request-key tree.
> 
> Move cache_seg_get() before the generation check. This preserves the
> get/put accounting for stale records while ensuring that the key is not
> accessed after cache_key_put().
> 
> Fixes: 1d57628ff95b ("dm-pcache: add persistent cache target in device-mapper")
> 
> Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
> ---
>  drivers/md/dm-pcache/cache_key.c | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)
> 
> diff --git a/drivers/md/dm-pcache/cache_key.c b/drivers/md/dm-pcache/cache_key.c
> index e068e878231b..b37d899f2d3c 100644
> --- a/drivers/md/dm-pcache/cache_key.c
> +++ b/drivers/md/dm-pcache/cache_key.c
> @@ -729,6 +729,7 @@ static int kset_replay(struct pcache_cache *cache, struct pcache_cache_kset_onme
>  		}
>  
>  		__set_bit(key->cache_pos.cache_seg->cache_seg_id, cache->seg_map);
> +		cache_seg_get(key->cache_pos.cache_seg);
>  
>  		/* Check if the segment generation is valid for insertion. */
>  		if (key->seg_gen < key->cache_pos.cache_seg->gen) {
> @@ -739,8 +740,6 @@ static int kset_replay(struct pcache_cache *cache, struct pcache_cache_kset_onme
>  			cache_key_insert(&cache->req_key_tree, key, true);
>  			spin_unlock(&cache_subtree->tree_lock);
>  		}
> -
> -		cache_seg_get(key->cache_pos.cache_seg);
>  	}
>  
>  	return 0;
> -- 
> 2.43.0
> 

Re: [PATCH] dm-pcache: fix use-after-free during cache replay

[Shuangpeng]

> On Aug 6, 2026, at 07:48, Mikulas Patocka <mpatocka@redhat.com> wrote:
> 
> Hi
> 
> This patch doesn't apply to the current device mapper working tree because 
> another patch was already committed there: c2e894eac398 ("dm-pcache: fix 
> use-after-free and invalid seg operations in kset_replay()").
> 
> Please, download the current device mapper repository from 
> git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm.git
> 
> Checkout the branch for-next.
> 
> Verify that the bug is still present there.

Thanks for pointing this out. Please ignore this patch.
Sorry for the noise.

Shuangpeng

> 
> If yes, send the patch against the "for-next" branch.
> 
> Mikulas
> 
> 
> 
> On Wed, 5 Aug 2026, Shuangpeng Bai wrote:
> 
>> kset_replay() drops the last reference to a stale cache key before
>> using key->cache_pos to acquire a reference to its cache segment. This
>> can dereference the freed key.
>> 
>> Segment references account for key records that have not yet been
>> consumed by key-log garbage collection. A reference is acquired for
>> every successfully recorded key, and the GC path drops one for every
>> record, including records whose segment generation has become stale.
>> Replay therefore has to restore the segment reference before deciding
>> whether the decoded key should be inserted into the request-key tree.
>> 
>> Move cache_seg_get() before the generation check. This preserves the
>> get/put accounting for stale records while ensuring that the key is not
>> accessed after cache_key_put().
>> 
>> Fixes: 1d57628ff95b ("dm-pcache: add persistent cache target in device-mapper")
>> 
>> Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
>> ---
>> drivers/md/dm-pcache/cache_key.c | 3 +--
>> 1 file changed, 1 insertion(+), 2 deletions(-)
>> 
>> diff --git a/drivers/md/dm-pcache/cache_key.c b/drivers/md/dm-pcache/cache_key.c
>> index e068e878231b..b37d899f2d3c 100644
>> --- a/drivers/md/dm-pcache/cache_key.c
>> +++ b/drivers/md/dm-pcache/cache_key.c
>> @@ -729,6 +729,7 @@ static int kset_replay(struct pcache_cache *cache, struct pcache_cache_kset_onme
>> }
>> 
>> __set_bit(key->cache_pos.cache_seg->cache_seg_id, cache->seg_map);
>> + cache_seg_get(key->cache_pos.cache_seg);
>> 
>> /* Check if the segment generation is valid for insertion. */
>> if (key->seg_gen < key->cache_pos.cache_seg->gen) {
>> @@ -739,8 +740,6 @@ static int kset_replay(struct pcache_cache *cache, struct pcache_cache_kset_onme
>> cache_key_insert(&cache->req_key_tree, key, true);
>> spin_unlock(&cache_subtree->tree_lock);
>> }
>> -
>> - cache_seg_get(key->cache_pos.cache_seg);
>> }
>> 
>> return 0;
>> -- 
>> 2.43.0
>> 
>