| Message ID | fc61fb63e534111f5837c204ec341c876637af69.1731513908.git.josef@toxicpanda.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | btrfs: fix incorrect comparison for delayed refs | expand |
On Wed, Nov 13, 2024 at 4:15 PM Josef Bacik <josef@toxicpanda.com> wrote: > > When I reworked delayed ref comparison in cf4f04325b2b ("btrfs: move > ->parent and ->ref_root into btrfs_delayed_ref_node"), I made a mistake > and returned -1 for the case where ref1->ref_root was > than > ref2->ref_root. This is a subtle bug that can result in improper > delayed ref running order, which can result in transaction aborts. > > cc: stable@vger.kernel.org > Fixes: cf4f04325b2b ("btrfs: move ->parent and ->ref_root into btrfs_delayed_ref_node") > Signed-off-by: Josef Bacik <josef@toxicpanda.com> Reviewed-by: Filipe Manana <fdmanana@suse.com> Ouch! > --- > fs/btrfs/delayed-ref.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/fs/btrfs/delayed-ref.c b/fs/btrfs/delayed-ref.c > index 4d2ad5b66928..0d878dbbabba 100644 > --- a/fs/btrfs/delayed-ref.c > +++ b/fs/btrfs/delayed-ref.c > @@ -299,7 +299,7 @@ static int comp_refs(struct btrfs_delayed_ref_node *ref1, > if (ref1->ref_root < ref2->ref_root) > return -1; > if (ref1->ref_root > ref2->ref_root) > - return -1; > + return 1; > if (ref1->type == BTRFS_EXTENT_DATA_REF_KEY) > ret = comp_data_refs(ref1, ref2); > } > -- > 2.43.0 > >
在 2024/11/14 02:35, Josef Bacik 写道: > When I reworked delayed ref comparison in cf4f04325b2b ("btrfs: move > ->parent and ->ref_root into btrfs_delayed_ref_node"), I made a mistake > and returned -1 for the case where ref1->ref_root was > than > ref2->ref_root. This is a subtle bug that can result in improper > delayed ref running order, which can result in transaction aborts. > > cc: stable@vger.kernel.org > Fixes: cf4f04325b2b ("btrfs: move ->parent and ->ref_root into btrfs_delayed_ref_node") > Signed-off-by: Josef Bacik <josef@toxicpanda.com> Reviewed-by: Qu Wenruo <wqu@suse.com> Thanks, Qu > --- > fs/btrfs/delayed-ref.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/fs/btrfs/delayed-ref.c b/fs/btrfs/delayed-ref.c > index 4d2ad5b66928..0d878dbbabba 100644 > --- a/fs/btrfs/delayed-ref.c > +++ b/fs/btrfs/delayed-ref.c > @@ -299,7 +299,7 @@ static int comp_refs(struct btrfs_delayed_ref_node *ref1, > if (ref1->ref_root < ref2->ref_root) > return -1; > if (ref1->ref_root > ref2->ref_root) > - return -1; > + return 1; > if (ref1->type == BTRFS_EXTENT_DATA_REF_KEY) > ret = comp_data_refs(ref1, ref2); > }
On Wed, Nov 13, 2024 at 11:05:13AM -0500, Josef Bacik wrote: > When I reworked delayed ref comparison in cf4f04325b2b ("btrfs: move > ->parent and ->ref_root into btrfs_delayed_ref_node"), I made a mistake > and returned -1 for the case where ref1->ref_root was > than > ref2->ref_root. This is a subtle bug that can result in improper > delayed ref running order, which can result in transaction aborts. > > cc: stable@vger.kernel.org > Fixes: cf4f04325b2b ("btrfs: move ->parent and ->ref_root into btrfs_delayed_ref_node") > Signed-off-by: Josef Bacik <josef@toxicpanda.com> Simple and serious fix, I'll send a pull request today. Thanks.
diff --git a/fs/btrfs/delayed-ref.c b/fs/btrfs/delayed-ref.c index 4d2ad5b66928..0d878dbbabba 100644 --- a/fs/btrfs/delayed-ref.c +++ b/fs/btrfs/delayed-ref.c @@ -299,7 +299,7 @@ static int comp_refs(struct btrfs_delayed_ref_node *ref1, if (ref1->ref_root < ref2->ref_root) return -1; if (ref1->ref_root > ref2->ref_root) - return -1; + return 1; if (ref1->type == BTRFS_EXTENT_DATA_REF_KEY) ret = comp_data_refs(ref1, ref2); }
When I reworked delayed ref comparison in cf4f04325b2b ("btrfs: move ->parent and ->ref_root into btrfs_delayed_ref_node"), I made a mistake and returned -1 for the case where ref1->ref_root was > than ref2->ref_root. This is a subtle bug that can result in improper delayed ref running order, which can result in transaction aborts. cc: stable@vger.kernel.org Fixes: cf4f04325b2b ("btrfs: move ->parent and ->ref_root into btrfs_delayed_ref_node") Signed-off-by: Josef Bacik <josef@toxicpanda.com> --- fs/btrfs/delayed-ref.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)