2023-09-14 11:32:57

by Kent Overstreet

Subject: Re: [PATCH 1/2] bcachefs: Fix a potential in the error handling path of use-after-free inbch2_dev_add()

On Wed, Sep 13, 2023 at 06:44:08PM +0200, Christophe JAILLET wrote:
> If __bch2_dev_attach_bdev() fails, bch2_dev_free() is called twice.
> Once here and another time in the error handling path.
>
> This leads to several use-after-free.
>
> Remove the redundant call and only rely on the error handling path.

Thanks, both applied

2023-09-14 17:20:23

by Christophe JAILLET

Subject: Re: [PATCH 1/2] bcachefs: Fix a potential in the error handling path of use-after-free inbch2_dev_add()

Le 14/09/2023 à 01:01, Kent Overstreet a écrit :
> On Wed, Sep 13, 2023 at 06:44:08PM +0200, Christophe JAILLET wrote:
>> If __bch2_dev_attach_bdev() fails, bch2_dev_free() is called twice.
>> Once here and another time in the error handling path.
>>
>> This leads to several use-after-free.
>>
>> Remove the redundant call and only rely on the error handling path.
> Thanks, both applied



If not too late, it is more a double-free than a use-after-free.

And I messed up the ordering of the words in the subject.

Sorry about that.

CJ