When the generation of the segment referenced by a replayed key is
stale, kset_replay() releases the key with cache_key_put(). The caller
holds the only reference, so the key is freed, yet the function then
dereferences key->cache_pos to pin the segment.
Pin the segment before the key can be released.
Fixes: 1d57628ff95b ("dm-pcache: add persistent cache target in device-mapper")
Cc: [email protected]
Signed-off-by: Wentao Liang <[email protected]>
---
drivers/md/dm-pcache/cache_key.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/md/dm-pcache/cache_key.c b/drivers/md/dm-pcache/cache_key.c
index e068e878231b..668c16a2e111 100644
--- a/drivers/md/dm-pcache/cache_key.c
+++ b/drivers/md/dm-pcache/cache_key.c
@@ -730,6 +730,12 @@ static int kset_replay(struct pcache_cache *cache, struct
pcache_cache_kset_onme
__set_bit(key->cache_pos.cache_seg->cache_seg_id,
cache->seg_map);
+ /*
+ * Pin the segment while the key is still alive: the stale key
+ * below is released and freed by cache_key_put().
+ */
+ cache_seg_get(key->cache_pos.cache_seg);
+
/* Check if the segment generation is valid for insertion. */
if (key->seg_gen < key->cache_pos.cache_seg->gen) {
cache_key_put(key);
@@ -739,8 +745,6 @@ static int kset_replay(struct pcache_cache *cache, struct
pcache_cache_kset_onme
cache_key_insert(&cache->req_key_tree, key, true);
spin_unlock(&cache_subtree->tree_lock);
}
-
- cache_seg_get(key->cache_pos.cache_seg);
}
return 0;
--
2.34.1
