[PATCH] bcachefs: fix uninitialised-access bug in bch2_alloc_sectors_start_trans

[PATCH] bcachefs: fix uninitialised-access bug in bch2_alloc_sectors_start_trans

[Qasim Ijaz]

During bch2_alloc_sectors_start_trans() if bch2_trans_relock() fails
the code jumps to label "err", skipping "cl" initialisation. Once at
the "err" label "cl" could potentially be accessed leading to a uinit
access.

Fix this by moving "cl" initialisation before bch2_trans_relock().

Fixes: c2e7fa88544d ("bcachefs: Use a loop for open_bucket_add_buckets() retries")
Signed-off-by: Qasim Ijaz <qasdev00@gmail.com>
---
 fs/bcachefs/alloc_foreground.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/fs/bcachefs/alloc_foreground.c b/fs/bcachefs/alloc_foreground.c
index 1410a4afb36a..ccd51bcbcec5 100644
--- a/fs/bcachefs/alloc_foreground.c
+++ b/fs/bcachefs/alloc_foreground.c
@@ -1277,6 +1277,11 @@ int bch2_alloc_sectors_start_trans(struct btree_trans *trans,
 
 	req->data_type		= req->wp->data_type;
 
+	/* If we're going to fall back to the whole fs, try nonblocking first */
+	struct closure *cl = req->target && !(flags & BCH_WRITE_only_specified_devs)
+		? _cl
+		: NULL;
+
 	ret = bch2_trans_relock(trans);
 	if (ret)
 		goto err;
@@ -1285,10 +1290,6 @@ int bch2_alloc_sectors_start_trans(struct btree_trans *trans,
 	if (req->data_type != BCH_DATA_user)
 		req->have_cache = true;
 
-	/* If we're going to fall back to the whole fs, try nonblocking first */
-	struct closure *cl = req->target && !(flags & BCH_WRITE_only_specified_devs)
-		? _cl
-		: NULL;
 	while (1) {
 		ret = open_bucket_add_buckets(trans, req, cl);
 		if (!ret ||
-- 
2.39.5

Re: [PATCH] bcachefs: fix uninitialised-access bug in bch2_alloc_sectors_start_trans

[Kent Overstreet]

On Wed, May 28, 2025 at 08:06:10PM +0100, Qasim Ijaz wrote:
> During bch2_alloc_sectors_start_trans() if bch2_trans_relock() fails
> the code jumps to label "err", skipping "cl" initialisation. Once at
> the "err" label "cl" could potentially be accessed leading to a uinit
> access.
> 
> Fix this by moving "cl" initialisation before bch2_trans_relock().
> 
> Fixes: c2e7fa88544d ("bcachefs: Use a loop for open_bucket_add_buckets() retries")
> Signed-off-by: Qasim Ijaz <qasdev00@gmail.com>

Thanks, folded this in.

> ---
>  fs/bcachefs/alloc_foreground.c | 9 +++++----
>  1 file changed, 5 insertions(+), 4 deletions(-)
> 
> diff --git a/fs/bcachefs/alloc_foreground.c b/fs/bcachefs/alloc_foreground.c
> index 1410a4afb36a..ccd51bcbcec5 100644
> --- a/fs/bcachefs/alloc_foreground.c
> +++ b/fs/bcachefs/alloc_foreground.c
> @@ -1277,6 +1277,11 @@ int bch2_alloc_sectors_start_trans(struct btree_trans *trans,
>  
>  	req->data_type		= req->wp->data_type;
>  
> +	/* If we're going to fall back to the whole fs, try nonblocking first */
> +	struct closure *cl = req->target && !(flags & BCH_WRITE_only_specified_devs)
> +		? _cl
> +		: NULL;
> +
>  	ret = bch2_trans_relock(trans);
>  	if (ret)
>  		goto err;
> @@ -1285,10 +1290,6 @@ int bch2_alloc_sectors_start_trans(struct btree_trans *trans,
>  	if (req->data_type != BCH_DATA_user)
>  		req->have_cache = true;
>  
> -	/* If we're going to fall back to the whole fs, try nonblocking first */
> -	struct closure *cl = req->target && !(flags & BCH_WRITE_only_specified_devs)
> -		? _cl
> -		: NULL;
>  	while (1) {
>  		ret = open_bucket_add_buckets(trans, req, cl);
>  		if (!ret ||
> -- 
> 2.39.5
>