From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qv1-f41.google.com (mail-qv1-f41.google.com [209.85.219.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BC453478865 for ; Thu, 6 Aug 2026 14:45:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.219.41 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786027515; cv=none; b=Amrn15d9n9mEs+LnXQZ9zu3icoo8wwI52yx05Wt0WylmvtgaV9tVW6zCODKDlol9rz81dY/qBKV9HHKZQzl+jcmHNahSDxEDQ2kDxIRssWd7L2GcMOZa58JQpfewbXIzmJTxz1TOdpg2hmL9B0kWLWIAm52M0m/cPCZDNJxkXfA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786027515; c=relaxed/simple; bh=UTsXKbyYl7vB7xqyJxdwaXmvVfokG/4uN65KKuOb7uM=; h=Content-Type:Mime-Version:Subject:From:In-Reply-To:Date:Cc: Message-Id:References:To; b=lknOqiSgu/smlVYohHgIKXtlNTDNSd55nNRoWMTp2+E55xLbdhuS9RfLcV0RnMZef0uWZkCA5nZD4+kRs8PIH14OjtLHpQYsbpYyrOGfPn0uEVG1iv+fa4g7+ftjN3w5/iOenx4/ziF4ukGOyHVp7T+vGYMxC8EKb5pGT0jtMhw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=QnVvln5N; arc=none smtp.client-ip=209.85.219.41 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="QnVvln5N" Received: by mail-qv1-f41.google.com with SMTP id 6a1803df08f44-8f186025973so22148976d6.0 for ; Thu, 06 Aug 2026 07:45:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786027512; x=1786632312; darn=vger.kernel.org; h=to:references:message-id:content-transfer-encoding:cc:date :in-reply-to:from:subject:mime-version:content-type:from:to:cc :subject:date:message-id:reply-to:content-type; bh=UTsXKbyYl7vB7xqyJxdwaXmvVfokG/4uN65KKuOb7uM=; b=QnVvln5NjtVzLhNhdv+/NQSJXr4fjtFCwoK5QsnGkN2xJd6Sdk/ZhbMHyNbxMpltE9 Bw51peAnvGdEzE3Dg7miPh0o9/N1aeoZ7/hBfRrNSCtLuHwL1syvkXX+d/BFBa4HFXhE a4acV1n8YZsG4NK9210Z7vJOTAkfvIU5/+Dg0UYAxY1gi6i3FgfvBI6PP4YSfsHOX2tG bTtJRfoZ+1MOCDy+g1OjwPgJ2zlZ028U+k5+qUGBAqjdRTFB82u9wN8XCpcapBpuvkvY nMymdRTe4+1ckkzINLJrj/v1iRU1F8ArdFa2hSDr8x4jGtUYcAmB4+OCZS/jNUZdD3SG G19Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786027512; x=1786632312; h=to:references:message-id:content-transfer-encoding:cc:date :in-reply-to:from:subject:mime-version:content-type:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=UTsXKbyYl7vB7xqyJxdwaXmvVfokG/4uN65KKuOb7uM=; b=OISZDRqYCUasggf4XDL8gU+yg431IAqav1a3vwKVvky30txO6a0G1KtwJtwNRszRGX 06W68UfASIr0y3GFOSODnG8HAfJSaJ9VBpYSGzUt7F7vAg3OzuioTY/qvWZR2PXgwk8n FGIxmjaRdNtXu8xZ/3DJBOxrpmLOwWHE3fvhDJ1ZVXiwEl6hDurcl1Fjyoz5i9KYGQjf 8Cv8OE0MOE27vFVRbX4VNCGfhVmWpFBgZihRkvwNESSJXIHCSzNIDiT5qM70dGzzhTbf Qx5/5NJ2MzoPO1vSJh7/CJCWipxmeSmRFVigsWya7mKUqZjRYRMt9Wtndqxh4bcq/uHD 31cw== X-Forwarded-Encrypted: i=1; AHgh+RoGQFHmc4Rc1SBnDQUzzh4aqJNXeHZRrqOnrd/pMQprpPAumphElVR7yabDGPQP3t6uJXQooJfk4GxyxMM=@vger.kernel.org X-Gm-Message-State: AOJu0Yz+j0zZoMq5isV4tCpUJdc7WbSmqbyZCRnd0Bb+wE64G1dnQCsY zJN18oKzCaLmXpmxCghTHdsJDPoTNLto+pK2Aj29xiO64C6s5H4QvA7m X-Gm-Gg: AR+sD128UrtC94DdNMQuevMMeiDIxJ2EWxdU8je0m7e/WBcKMCmV6DT1JWf+IUZvLsZ 4pNID6Y2jmi10L2FkveLA2wrWItvYtusGvTw26mwHRlXCh1DezbbBVngITlmHEP7+oyR8Rzm9Cf 62UVxmeKZAv/F2+txvviOHS5IUBaNF+JdSVIhHXGxkUiklYTcL33A0kzy1qli4hbuplmKA24QRD /H7Y+xN9kd+ywpmhdxvP2y2AGjWhqnjNjAXyPKSr8/Ndb/04gJ3Ci0yvwzNNQ5ZiE0+UI5nMBc8 pnYQIddkvXL+cm43bsT0O92AlNWZk9w8ZwpLmoCcf2svzFUE3tptAT/S4O8P8IYzSpli2jZgY3r Aao3haRYMx2S5R8gnKtUu7Lgu1z0CvHOHghOXuwRERmsSScgV9ST4qnpCO6T09oKgmis6tUraTD nkRbPqeA1VCdbv8XY7eQy+gC5EuPkBv+izKW2iUddYUkyywpRyTZg1BTTqu/TlcpRb6Z/Ai5zoC 5/DQPu0Sw1JEIJNyTNgYHK9KsVHXMzD X-Received: by 2002:a05:6214:501d:b0:8f4:821d:95f7 with SMTP id 6a1803df08f44-9088124ccb0mr159085776d6.18.1786027512206; Thu, 06 Aug 2026 07:45:12 -0700 (PDT) Received: from smtpclient.apple ([2600:1016:b105:b4ee:59bb:6356:a055:a7a4]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-908800cd7cdsm55156756d6.44.2026.08.06.07.45.11 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Thu, 06 Aug 2026 07:45:11 -0700 (PDT) Content-Type: text/plain; charset=us-ascii Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3864.600.51.1.1\)) Subject: Re: [PATCH] dm-pcache: fix use-after-free during cache replay From: Shuangpeng In-Reply-To: Date: Thu, 6 Aug 2026 10:44:39 -0400 Cc: Dongsheng Yang , Jianyun Gao , Zheng Gu , dm-devel@lists.linux.dev, linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Message-Id: References: <20260805171637.3557122-1-shuangpeng.kernel@gmail.com> To: Mikulas Patocka X-Mailer: Apple Mail (2.3864.600.51.1.1) > On Aug 6, 2026, at 07:48, Mikulas Patocka wrote: >=20 > Hi >=20 > This patch doesn't apply to the current device mapper working tree = because=20 > another patch was already committed there: c2e894eac398 ("dm-pcache: = fix=20 > use-after-free and invalid seg operations in kset_replay()"). >=20 > Please, download the current device mapper repository from=20 > = git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm.git >=20 > Checkout the branch for-next. >=20 > Verify that the bug is still present there. Thanks for pointing this out. Please ignore this patch. Sorry for the noise. Shuangpeng >=20 > If yes, send the patch against the "for-next" branch. >=20 > Mikulas >=20 >=20 >=20 > On Wed, 5 Aug 2026, Shuangpeng Bai wrote: >=20 >> kset_replay() drops the last reference to a stale cache key before >> using key->cache_pos to acquire a reference to its cache segment. = This >> can dereference the freed key. >>=20 >> Segment references account for key records that have not yet been >> consumed by key-log garbage collection. A reference is acquired for >> every successfully recorded key, and the GC path drops one for every >> record, including records whose segment generation has become stale. >> Replay therefore has to restore the segment reference before deciding >> whether the decoded key should be inserted into the request-key tree. >>=20 >> Move cache_seg_get() before the generation check. This preserves the >> get/put accounting for stale records while ensuring that the key is = not >> accessed after cache_key_put(). >>=20 >> Fixes: 1d57628ff95b ("dm-pcache: add persistent cache target in = device-mapper") >>=20 >> Signed-off-by: Shuangpeng Bai >> --- >> drivers/md/dm-pcache/cache_key.c | 3 +-- >> 1 file changed, 1 insertion(+), 2 deletions(-) >>=20 >> diff --git a/drivers/md/dm-pcache/cache_key.c = b/drivers/md/dm-pcache/cache_key.c >> index e068e878231b..b37d899f2d3c 100644 >> --- a/drivers/md/dm-pcache/cache_key.c >> +++ b/drivers/md/dm-pcache/cache_key.c >> @@ -729,6 +729,7 @@ static int kset_replay(struct pcache_cache = *cache, struct pcache_cache_kset_onme >> } >>=20 >> __set_bit(key->cache_pos.cache_seg->cache_seg_id, cache->seg_map); >> + cache_seg_get(key->cache_pos.cache_seg); >>=20 >> /* Check if the segment generation is valid for insertion. */ >> if (key->seg_gen < key->cache_pos.cache_seg->gen) { >> @@ -739,8 +740,6 @@ static int kset_replay(struct pcache_cache = *cache, struct pcache_cache_kset_onme >> cache_key_insert(&cache->req_key_tree, key, true); >> spin_unlock(&cache_subtree->tree_lock); >> } >> - >> - cache_seg_get(key->cache_pos.cache_seg); >> } >>=20 >> return 0; >> --=20 >> 2.43.0 >>=20 >=20