From 71933fb69b7c5fe5efd2119b645d4fde337a6f3f Mon Sep 17 00:00:00 2001 From: Christophe JAILLET Date: Wed, 13 Sep 2023 18:44:08 +0200 Subject: [PATCH] bcachefs: Fix use-after-free in bch2_dev_add() If __bch2_dev_attach_bdev() fails, bch2_dev_free() is called twice. Once here and another time in the error handling path. This leads to several use-after-free. Remove the redundant call and only rely on the error handling path. Fixes: 6a44735653d4 ("bcachefs: Improved superblock-related error messages") Signed-off-by: Christophe JAILLET Signed-off-by: Kent Overstreet --- fs/bcachefs/super.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/fs/bcachefs/super.c b/fs/bcachefs/super.c index 94e296397e32..9f852a6dd76a 100644 --- a/fs/bcachefs/super.c +++ b/fs/bcachefs/super.c @@ -1613,10 +1613,8 @@ int bch2_dev_add(struct bch_fs *c, const char *path) bch2_dev_usage_init(ca); ret = __bch2_dev_attach_bdev(ca, &sb); - if (ret) { - bch2_dev_free(ca); + if (ret) goto err; - } ret = bch2_dev_journal_alloc(ca); if (ret) {