When the generation of the segment referenced by a replayed key is stale, kset_replay() releases the key with cache_key_put(). The caller holds the only reference, so the key is freed, yet the function then dereferences key->cache_pos to pin the segment. Pin the segment before the key can be released. Fixes: 1d57628ff95b ("dm-pcache: add persistent cache target in device-mapper") Cc: stable@vger.kernel.org Signed-off-by: Wentao Liang --- drivers/md/dm-pcache/cache_key.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/md/dm-pcache/cache_key.c b/drivers/md/dm-pcache/cache_key.c index e068e878231b..668c16a2e111 100644 --- a/drivers/md/dm-pcache/cache_key.c +++ b/drivers/md/dm-pcache/cache_key.c @@ -730,6 +730,12 @@ static int kset_replay(struct pcache_cache *cache, struct pcache_cache_kset_onme __set_bit(key->cache_pos.cache_seg->cache_seg_id, cache->seg_map); + /* + * Pin the segment while the key is still alive: the stale key + * below is released and freed by cache_key_put(). + */ + cache_seg_get(key->cache_pos.cache_seg); + /* Check if the segment generation is valid for insertion. */ if (key->seg_gen < key->cache_pos.cache_seg->gen) { cache_key_put(key); @@ -739,8 +745,6 @@ static int kset_replay(struct pcache_cache *cache, struct pcache_cache_kset_onme cache_key_insert(&cache->req_key_tree, key, true); spin_unlock(&cache_subtree->tree_lock); } - - cache_seg_get(key->cache_pos.cache_seg); } return 0; -- 2.34.1