Hi Zheng, ---- On Fri, 31 Oct 2025 10:01:23 +0800 Zheng Gu <[email protected]> wrote --- >> On Thu, Oct 30, 2025 at 8:36 PM Li Chen <[email protected]> wrote:From: Li >> Chen <[email protected]> >> >> Before this change pcache_meta_find_latest() was copying each >> slot directly into meta_ret while scanning. If no valid slot >> was found and the function returned NULL, meta_ret still held >> whatever was last copied (possibly CRC-bad). Later users >> (e.g. cache_segs_init) could mistakenly trust that data. > > This functions is * __must_check*, users must check the return value first > before touching the meta_ret, so it should not be a problem here.
Right now, the callers only check the return value with IS_ERR(). If the function returns NULL instead of an error pointer, a caller like cache_info_init() will assume that no valid cache_info was found because all cache_info are corrupted. Instead, it will try to init a new one, and then return 0 (success), https://github.com/torvalds/linux/blob/master/drivers/md/dm-pcache/cache.c#L61 Later, cache_tail_init() will access cache->cache_info.flags. But in this path all cache_info may have already been corrupted, and the CRCs are mismatched (https://github.com/torvalds/linux/blob/ba36dd5ee6fd4643ebbf6ee6eefcecf0b07e35c7/drivers/md/dm-pcache/pcache_internal.h#L97), so flags may contain garbage. This commit fixes this issue by allocating a temp buffer with kvmalloc, so meta_ret would never contain corrupted values. Regards, Li
