From 20e6d9a8d4050220f4e0a0195d102abaf2c8439b Mon Sep 17 00:00:00 2001 From: Kent Overstreet Date: Sun, 16 Jul 2023 21:56:18 -0400 Subject: [PATCH] bcachefs: Fix lookup_inode_for_snapshot() This fixes a use-after-free. Signed-off-by: Kent Overstreet --- fs/bcachefs/fsck.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/fs/bcachefs/fsck.c b/fs/bcachefs/fsck.c index c8599978ae46f..0d7344ff64c0e 100644 --- a/fs/bcachefs/fsck.c +++ b/fs/bcachefs/fsck.c @@ -682,6 +682,7 @@ found: if (snapshot != i->snapshot && !is_whiteout) { struct inode_walker_entry new = *i; + size_t pos; int ret; new.snapshot = snapshot; @@ -693,9 +694,12 @@ found: while (i > w->inodes.data && i[-1].snapshot > snapshot) --i; - ret = darray_insert_item(&w->inodes, i - w->inodes.data, new); + pos = i - w->inodes.data; + ret = darray_insert_item(&w->inodes, pos, new); if (ret) return ERR_PTR(ret); + + i = w->inodes.data + pos; } return i; -- 2.30.2