afs: Fix the volume AFS_VOLUME_RM_TREE is set on

Fix afs_insert_volume_into_cell() to set AFS_VOLUME_RM_TREE on the volume
replaced, not the new volume, as it's now removed from the cell's volume
tree.  This will cause the old volume to be removed from the tree twice and
the new volume never to be removed.

Fixes: 9a6b294ab496 ("afs: Fix use-after-free due to get/remove race in volume tree")
Closes: https://sashiko.dev/#/patchset/20260618074903.2374756-1-dhowells%40redhat.com
Signed-off-by: David Howells <dhowells@redhat.com>
Link: https://patch.msgid.link/20260622090856.2746629-21-dhowells@redhat.com
cc: Marc Dionne <marc.dionne@auristor.com>
cc: linux-afs@lists.infradead.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

diff --git a/fs/afs/volume.c b/fs/afs/volume.c
index 9ae5c8ad2e04b419e0b074cacb560cc8037f97a1..4f79d25ec37f4b7cf0469ad3ee2b821185f2e795 100644 (file)
--- a/fs/afs/volume.c
+++ b/fs/afs/volume.c
@@ -40,7 +40,7 @@ static struct afs_volume *afs_insert_volume_into_cell(struct afs_cell *cell,
                                goto found;
                        }
 
-                       set_bit(AFS_VOLUME_RM_TREE, &volume->flags);
+                       set_bit(AFS_VOLUME_RM_TREE, &p->flags);
                        rb_replace_node_rcu(&p->cell_node, &volume->cell_node, &cell->volumes);
                }
        }