bcachefs: Fix UAF in bchfs_read()
authorKent Overstreet <kent.overstreet@linux.dev>
Sat, 5 Apr 2025 16:26:43 +0000 (12:26 -0400)
committerKent Overstreet <kent.overstreet@linux.dev>
Sun, 6 Apr 2025 23:13:43 +0000 (19:13 -0400)
commit34b47e3d73a21ef992905746cdb044ce02d3b29a
treefd5e41e953bbe75d3322a020c41c0fca70f1917f
parent4a22a7332341f49e60b804811fee7edf87909e9e
bcachefs: Fix UAF in bchfs_read()

Commit 3ba0240a8789 fixed a bug in the read retry path in __bch2_read(),
and changed bchfs_read() to match - to avoid a landmine if
bch2_read_extent() ever starts returning transaction restarts.

But that was incorrect, because bchfs_read() doesn't use a separate
stack allocated bvec_iter, it uses the one in the rbio being submitted.

Add a comment explaining the issue, and revert the buggy change.

Fixes: 3ba0240a8789 ("bcachefs: Fix silent short reads in data read retry path")
Reported-by: syzbot+2deb10b8dc9aae6fab67@syzkaller.appspotmail.com
Signed-off-by: Kent Overstreet <kent.overstreet@linux.dev>
fs/bcachefs/fs-io-buffered.c