On Wed, May 28, 2025 at 08:06:10PM +0100, Qasim Ijaz wrote:
> During bch2_alloc_sectors_start_trans() if bch2_trans_relock() fails
> the code jumps to label "err", skipping "cl" initialisation. Once at
> the "err" label "cl" could potentially be accessed leading to a uinit
> access.
>
> Fix this by moving "cl" initialisation before bch2_trans_relock().
>
> Fixes: c2e7fa88544d ("bcachefs: Use a loop for open_bucket_add_buckets()
> retries")
> Signed-off-by: Qasim Ijaz <[email protected]>
Thanks, folded this in.
> ---
> fs/bcachefs/alloc_foreground.c | 9 +++++----
> 1 file changed, 5 insertions(+), 4 deletions(-)
>
> diff --git a/fs/bcachefs/alloc_foreground.c b/fs/bcachefs/alloc_foreground.c
> index 1410a4afb36a..ccd51bcbcec5 100644
> --- a/fs/bcachefs/alloc_foreground.c
> +++ b/fs/bcachefs/alloc_foreground.c
> @@ -1277,6 +1277,11 @@ int bch2_alloc_sectors_start_trans(struct btree_trans
> *trans,
>
> req->data_type = req->wp->data_type;
>
> + /* If we're going to fall back to the whole fs, try nonblocking first */
> + struct closure *cl = req->target && !(flags &
> BCH_WRITE_only_specified_devs)
> + ? _cl
> + : NULL;
> +
> ret = bch2_trans_relock(trans);
> if (ret)
> goto err;
> @@ -1285,10 +1290,6 @@ int bch2_alloc_sectors_start_trans(struct btree_trans
> *trans,
> if (req->data_type != BCH_DATA_user)
> req->have_cache = true;
>
> - /* If we're going to fall back to the whole fs, try nonblocking first */
> - struct closure *cl = req->target && !(flags &
> BCH_WRITE_only_specified_devs)
> - ? _cl
> - : NULL;
> while (1) {
> ret = open_bucket_add_buckets(trans, req, cl);
> if (!ret ||
> --
> 2.39.5
>
