bcachefs: Fix lookup_inode_for_snapshot()

This fixes a use-after-free.

Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>

diff --git a/fs/bcachefs/fsck.c b/fs/bcachefs/fsck.c
index c8599978ae46f359ae16c68a53a27669dacf732e..0d7344ff64c0eee0f56370fd73d61dd666e6ac96 100644 (file)
--- a/fs/bcachefs/fsck.c
+++ b/fs/bcachefs/fsck.c
@@ -682,6 +682,7 @@ found:
 
        if (snapshot != i->snapshot && !is_whiteout) {
                struct inode_walker_entry new = *i;
+               size_t pos;
                int ret;
 
                new.snapshot = snapshot;
@@ -693,9 +694,12 @@ found:
                while (i > w->inodes.data && i[-1].snapshot > snapshot)
                        --i;
 
-               ret = darray_insert_item(&w->inodes, i - w->inodes.data, new);
+               pos = i - w->inodes.data;
+               ret = darray_insert_item(&w->inodes, pos, new);
                if (ret)
                        return ERR_PTR(ret);
+
+               i = w->inodes.data + pos;
        }
 
        return i;