bcachefs: Fix UAF in bchfs_read()
Commit 3ba0240a fixed a bug in the read retry path in __bch2_read(), and changed bchfs_read() to match - to avoid a landmine if bch2_read_extent() ever starts returning transaction restarts. But that was incorrect, because bchfs_read() doesn't use a separate stack allocated bvec_iter, it uses the one in the rbio being submitted. Add a comment explaining the issue, and revert the buggy change. Fixes: 3ba0240a ("bcachefs: Fix silent short reads in data read retry path") Reported-by:<syzbot+2deb10b8dc9aae6fab67@syzkaller.appspotmail.com> Signed-off-by:
Kent Overstreet <kent.overstreet@linux.dev>
Loading
Please sign in to comment