From nobody Tue Aug 25 02:38:26 2026 Received: from mail-qk1-f170.google.com (mail-qk1-f170.google.com [209.85.222.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C51CB3CF1FD for ; Wed, 5 Aug 2026 17:16:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.222.170 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785950218; cv=none; b=OCuDG+6i1pTMpFl7rjCiaxB5gY4zxqydssw5PsfTN/xgroB3dcpGbGpDAuMnBWRNyCxMt0RNn5yPKMQzKj5NQ+BpN8WqKRwpntuANm0+4rXcZMXRBn9Q9w5lC7+LwqrvEJfYCcITDowbrmv41L/jOpQg/HFID2lDlGmsMMLjJZI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785950218; c=relaxed/simple; bh=61hOSHdRcSQvef+MVyz7VMXKTF4406B2mDU6fZCOjlQ=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=nwMHni4P+06C2z0A+oVWMNuis4Hx0aX/R2rGpP0TUmQzsePY/kQ+88+kyNfgWfnrJskbe7GTPe7A/QiP8vaCKswo1GuqqGnv7UaAiSkw61CvK9dv5TBhzhJrbFTFaAJFqeZUIMOP5+9CfHnvuKFNJ2Oq+qBjjS/xm+MO9IvLADI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=mDfrs5et; arc=none smtp.client-ip=209.85.222.170 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="mDfrs5et" Received: by mail-qk1-f170.google.com with SMTP id af79cd13be357-92ea24a2dbfso100889185a.0 for ; Wed, 05 Aug 2026 10:16:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785950209; x=1786555009; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=8+MjtruiJEICdVzo94Bi/JZM6/fj4g6t2JFO8BqK4D0=; b=mDfrs5etN3INA1f/zt2rzcmlYrTD3Z9x9X8sUm94VtyrULd2Ztq6J7FOrbIp6c9SId WaOFDnVzVxW1RlbSKeDz2ZiL12n4g6CK3yuugHrOgXgE6tItQ6/9dS+c9eR3UG+94yJv Y8hyDqbrA3fio3c55GcU1udzaEYH+o7tAZXVX3/RXmx6B6N/DKgNzXdACPOo1Ot/Vxee tnLt2eAnaKBeO4PX2agg8FUIVmx26UNFCmSETs92QdYvmcETukIk4zpojlgSx6t039DS yVZ1q3stqBZDMf2vZRRk6jPTvX6U1mtm0r00zQsY8rBlwopQsigkTcFIloHRRRiyVceE YVoQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785950209; x=1786555009; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=8+MjtruiJEICdVzo94Bi/JZM6/fj4g6t2JFO8BqK4D0=; b=WRLm6xqU3Kjx6GGZc9z0GYSdC9jzR9vz/Q3DydV1YI75V56XLdSHsEOs3WPXOL085M E0hVZi9yJI4jLsFxyh2je9SFqL6tYwCNgFzeB5nZWr/7SZO3PrayFZulfbmH9AZ2PC63 5UwcQXaGiUXwPQcAPXyZv9JR1YODd5j5Q0rrop8UcmIdUF28UpYrbBxgu9bwrZfmcE2Q whYskPJkN5rFcajq0iQiW5Zwd+/ZljSpveD69ttIjL14xHMzxrCmtrk5f0IkJzzjTQVY xLr8Hm/t2uEzDoMD8pDjM95OG69Uod1pnA8drePz2KXKfHDAB/b8QmEaPC4lbFEvZW8E c9vg== X-Forwarded-Encrypted: i=1; AHgh+RplJA5i2M1JKGka45boMOmn7oG7YZp5aAOb/JCD1bqWKazqOyiJb4bZCupTNRy3OcfFBZNhJsLMyNElrKc=@vger.kernel.org X-Gm-Message-State: AOJu0YwH1IzrANI/MH1cTRgGh+IXrd9ejwKS1+IVpXRRws1cHu935EZU ju+JC7AnpN5nVtkTwyXRUXE0TzkhMxmC5GHFiVhmm0jTaQlmKCiYklNb X-Gm-Gg: AR+sD11ve+3P7yKSTwX0tRMWmaK5SdyGk5Tc4qY4S1Kd1/9WrSIYgJedFi34o0nysH1 eU5ZU6R3Oy6tyxyMgf6UeBx0NHEn4CAugGsOS8zZOlq12duXZMBTcx2SLU+bOwkWlrNJlOXLg7z L63syBZdLN2NZxLqXTv/meslb0O3/8q5XjXMqDgKTqaMKJxeQyqt/Ee9C6n2oUWifudFP5du8Ov HXeYiHimm6ax+VmPlrihBsVCkFpcBYFYH3exgk1DAN632f4pV1UjBMFl0H+PiERtbHoWYcxRCn7 evModZHbR5bvS2191KUHslvYhhaeJQRqlo1Ti1CTdzA+zu5/hlODtDj5l4sxynQJZ/sFPcAUa+o VGX7xSWUikZ6+0uvmHF6drUJDLmK0gUwck71qu4HCZvqKCqOw7N+DAQWJ/EoTaihfn5Q7y4L+yo AcXhe01RMXvQScHhonbCUWD5J0HBpUAGGafr0FHrMaSQULgwUkJJyJr/r0TnMvITLXmskE+E3Ih NWWN7mwBVzJckROQA== X-Received: by 2002:a05:620a:a18a:10b0:92e:6637:da8 with SMTP id af79cd13be357-93649190171mr629657185a.28.1785950208674; Wed, 05 Aug 2026 10:16:48 -0700 (PDT) Received: from i4-l-hqh5357-03.ad.psu.edu ([130.203.139.71]) by smtp.gmail.com with ESMTPSA id af79cd13be357-9364a5654d4sm191207485a.36.2026.08.05.10.16.48 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 05 Aug 2026 10:16:48 -0700 (PDT) From: Shuangpeng Bai To: Dongsheng Yang , Zheng Gu Cc: Mikulas Patocka , dm-devel@lists.linux.dev, linux-kernel@vger.kernel.org, Shuangpeng Bai Subject: [PATCH] dm-pcache: fix use-after-free during cache replay Date: Wed, 5 Aug 2026 13:16:37 -0400 Message-ID: <20260805171637.3557122-1-shuangpeng.kernel@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" kset_replay() drops the last reference to a stale cache key before using key->cache_pos to acquire a reference to its cache segment. This can dereference the freed key. Segment references account for key records that have not yet been consumed by key-log garbage collection. A reference is acquired for every successfully recorded key, and the GC path drops one for every record, including records whose segment generation has become stale. Replay therefore has to restore the segment reference before deciding whether the decoded key should be inserted into the request-key tree. Move cache_seg_get() before the generation check. This preserves the get/put accounting for stale records while ensuring that the key is not accessed after cache_key_put(). Fixes: 1d57628ff95b ("dm-pcache: add persistent cache target in device-mapp= er") Signed-off-by: Shuangpeng Bai --- drivers/md/dm-pcache/cache_key.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/md/dm-pcache/cache_key.c b/drivers/md/dm-pcache/cache_= key.c index e068e878231b..b37d899f2d3c 100644 --- a/drivers/md/dm-pcache/cache_key.c +++ b/drivers/md/dm-pcache/cache_key.c @@ -729,6 +729,7 @@ static int kset_replay(struct pcache_cache *cache, stru= ct pcache_cache_kset_onme } =20 __set_bit(key->cache_pos.cache_seg->cache_seg_id, cache->seg_map); + cache_seg_get(key->cache_pos.cache_seg); =20 /* Check if the segment generation is valid for insertion. */ if (key->seg_gen < key->cache_pos.cache_seg->gen) { @@ -739,8 +740,6 @@ static int kset_replay(struct pcache_cache *cache, stru= ct pcache_cache_kset_onme cache_key_insert(&cache->req_key_tree, key, true); spin_unlock(&cache_subtree->tree_lock); } - - cache_seg_get(key->cache_pos.cache_seg); } =20 return 0; --=20 2.43.0