[PATCH] dm-pcache: Fix use-after-free in kset_replay()

[Wentao Liang]

When the generation of the segment referenced by a replayed key is
stale, kset_replay() releases the key with cache_key_put().  The caller
holds the only reference, so the key is freed, yet the function then
dereferences key->cache_pos to pin the segment.

Pin the segment before the key can be released.

Fixes: 1d57628ff95b ("dm-pcache: add persistent cache target in device-mapper")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
---
 drivers/md/dm-pcache/cache_key.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/md/dm-pcache/cache_key.c b/drivers/md/dm-pcache/cache_key.c
index e068e878231b..668c16a2e111 100644
--- a/drivers/md/dm-pcache/cache_key.c
+++ b/drivers/md/dm-pcache/cache_key.c
@@ -730,6 +730,12 @@ static int kset_replay(struct pcache_cache *cache, struct pcache_cache_kset_onme
 
 		__set_bit(key->cache_pos.cache_seg->cache_seg_id, cache->seg_map);
 
+		/*
+		 * Pin the segment while the key is still alive: the stale key
+		 * below is released and freed by cache_key_put().
+		 */
+		cache_seg_get(key->cache_pos.cache_seg);
+
 		/* Check if the segment generation is valid for insertion. */
 		if (key->seg_gen < key->cache_pos.cache_seg->gen) {
 			cache_key_put(key);
@@ -739,8 +745,6 @@ static int kset_replay(struct pcache_cache *cache, struct pcache_cache_kset_onme
 			cache_key_insert(&cache->req_key_tree, key, true);
 			spin_unlock(&cache_subtree->tree_lock);
 		}
-
-		cache_seg_get(key->cache_pos.cache_seg);
 	}
 
 	return 0;
-- 
2.34.1