Hi
This patch doesn't apply to the current device mapper working tree because
another patch was already committed there: c2e894eac398 ("dm-pcache: fix
use-after-free and invalid seg operations in kset_replay()").
Please, download the current device mapper repository from
git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm.git
Checkout the branch for-next.
Verify that the bug is still present there.
If yes, send the patch against the "for-next" branch.
Mikulas
On Wed, 5 Aug 2026, Shuangpeng Bai wrote:
> kset_replay() drops the last reference to a stale cache key before
> using key->cache_pos to acquire a reference to its cache segment. This
> can dereference the freed key.
>
> Segment references account for key records that have not yet been
> consumed by key-log garbage collection. A reference is acquired for
> every successfully recorded key, and the GC path drops one for every
> record, including records whose segment generation has become stale.
> Replay therefore has to restore the segment reference before deciding
> whether the decoded key should be inserted into the request-key tree.
>
> Move cache_seg_get() before the generation check. This preserves the
> get/put accounting for stale records while ensuring that the key is not
> accessed after cache_key_put().
>
> Fixes: 1d57628ff95b ("dm-pcache: add persistent cache target in
> device-mapper")
>
> Signed-off-by: Shuangpeng Bai <[email protected]>
> ---
> drivers/md/dm-pcache/cache_key.c | 3 +--
> 1 file changed, 1 insertion(+), 2 deletions(-)
>
> diff --git a/drivers/md/dm-pcache/cache_key.c
> b/drivers/md/dm-pcache/cache_key.c
> index e068e878231b..b37d899f2d3c 100644
> --- a/drivers/md/dm-pcache/cache_key.c
> +++ b/drivers/md/dm-pcache/cache_key.c
> @@ -729,6 +729,7 @@ static int kset_replay(struct pcache_cache *cache, struct
> pcache_cache_kset_onme
> }
>
> __set_bit(key->cache_pos.cache_seg->cache_seg_id,
> cache->seg_map);
> + cache_seg_get(key->cache_pos.cache_seg);
>
> /* Check if the segment generation is valid for insertion. */
> if (key->seg_gen < key->cache_pos.cache_seg->gen) {
> @@ -739,8 +740,6 @@ static int kset_replay(struct pcache_cache *cache, struct
> pcache_cache_kset_onme
> cache_key_insert(&cache->req_key_tree, key, true);
> spin_unlock(&cache_subtree->tree_lock);
> }
> -
> - cache_seg_get(key->cache_pos.cache_seg);
> }
>
> return 0;
> --
> 2.43.0
>
