Hi
This patch conflicts with the patch
c2e894eac398b258f12fdec73ed6ba081047f7b3 (which also fixes the
use-after-free condition).
Please, download the current kernel 7.3-rc4 and test if the bug is still
present there. If it is, send a patch against 7.3-rc4.
Mikulas
On Thu, 17 Sep 2026, Wentao Liang wrote:
> When the generation of the segment referenced by a replayed key is
> stale, kset_replay() releases the key with cache_key_put(). The caller
> holds the only reference, so the key is freed, yet the function then
> dereferences key->cache_pos to pin the segment.
>
> Pin the segment before the key can be released.
>
> Fixes: 1d57628ff95b ("dm-pcache: add persistent cache target in
> device-mapper")
> Cc: [email protected]
> Signed-off-by: Wentao Liang <[email protected]>
> ---
> drivers/md/dm-pcache/cache_key.c | 8 ++++++--
> 1 file changed, 6 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/md/dm-pcache/cache_key.c
> b/drivers/md/dm-pcache/cache_key.c
> index e068e878231b..668c16a2e111 100644
> --- a/drivers/md/dm-pcache/cache_key.c
> +++ b/drivers/md/dm-pcache/cache_key.c
> @@ -730,6 +730,12 @@ static int kset_replay(struct pcache_cache *cache,
> struct pcache_cache_kset_onme
>
> __set_bit(key->cache_pos.cache_seg->cache_seg_id,
> cache->seg_map);
>
> + /*
> + * Pin the segment while the key is still alive: the stale key
> + * below is released and freed by cache_key_put().
> + */
> + cache_seg_get(key->cache_pos.cache_seg);
> +
> /* Check if the segment generation is valid for insertion. */
> if (key->seg_gen < key->cache_pos.cache_seg->gen) {
> cache_key_put(key);
> @@ -739,8 +745,6 @@ static int kset_replay(struct pcache_cache *cache, struct
> pcache_cache_kset_onme
> cache_key_insert(&cache->req_key_tree, key, true);
> spin_unlock(&cache_subtree->tree_lock);
> }
> -
> - cache_seg_get(key->cache_pos.cache_seg);
> }
>
> return 0;
> --
> 2.34.1
>
