bcachefs: Fix UAF in __promote_alloc() error path

If we error in data_update_init() after adding to the rhashtable of
outstanding promotes, kfree_rcu() is required.

Reported-by: Reed Riley <reed@riley.engineer>
Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>

diff --git a/fs/bcachefs/io_read.c b/fs/bcachefs/io_read.c
index ac6a6fcc2bb8fd679c14d4d383c787fea2017ad5..b3b934a87c6de1962d07e93ac2ff9843729edaee 100644 (file)
--- a/fs/bcachefs/io_read.c
+++ b/fs/bcachefs/io_read.c
@@ -262,7 +262,8 @@ err:
                bio_free_pages(&(*rbio)->bio);
        kfree(*rbio);
        *rbio = NULL;
-       kfree(op);
+       /* We may have added to the rhashtable and thus need rcu freeing: */
+       kfree_rcu(op, rcu);
        bch2_write_ref_put(c, BCH_WRITE_REF_promote);
        return ERR_PTR(ret);
 }