| Message ID | 1524988782-2680-1-git-send-email-ethanwu@synology.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On Sun, Apr 29, 2018 at 03:59:42PM +0800, ethanwu wrote: > In preivous patch: > Btrfs: kill trans in run_delalloc_nocow and btrfs_cross_ref_exist If you know which patch introduced the bug, please add it with the commit id and as Fixes: e4c3b2dcd144 ("Btrfs: kill trans in run_delalloc_nocow and btrfs_cross_ref_exist") to the tags (signed-off section). > We avoid starting btrfs transaction and get this information from > fs_info->running_transaction directly. > > When accessing running_transaction in check_delayed_ref, there's a > chance that current transaction will be freed by commit transaction > after the NULL pointer check of running_transaction is passed. > > After looking all the other places using fs_info->running_transaction, > they are either protected by trans_lock or holding the transactions. > > Fix this by using trans_lock and increasing the use_count. > > Signed-off-by: ethanwu <ethanwu@synology.com> Added to next, thanks. -- To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c index c1618ab..7c302ed 100644 --- a/fs/btrfs/extent-tree.c +++ b/fs/btrfs/extent-tree.c @@ -3149,7 +3149,11 @@ static noinline int check_delayed_ref(struct btrfs_root *root, struct rb_node *node; int ret = 0; + spin_lock(&root->fs_info->trans_lock); cur_trans = root->fs_info->running_transaction; + if (cur_trans) + refcount_inc(&cur_trans->use_count); + spin_unlock(&root->fs_info->trans_lock); if (!cur_trans) return 0; @@ -3158,6 +3162,7 @@ static noinline int check_delayed_ref(struct btrfs_root *root, head = btrfs_find_delayed_ref_head(delayed_refs, bytenr); if (!head) { spin_unlock(&delayed_refs->lock); + btrfs_put_transaction(cur_trans); return 0; } @@ -3174,6 +3179,7 @@ static noinline int check_delayed_ref(struct btrfs_root *root, mutex_lock(&head->mutex); mutex_unlock(&head->mutex); btrfs_put_delayed_ref_head(head); + btrfs_put_transaction(cur_trans); return -EAGAIN; } spin_unlock(&delayed_refs->lock); @@ -3206,6 +3212,7 @@ static noinline int check_delayed_ref(struct btrfs_root *root, } spin_unlock(&head->lock); mutex_unlock(&head->mutex); + btrfs_put_transaction(cur_trans); return ret; }
In preivous patch: Btrfs: kill trans in run_delalloc_nocow and btrfs_cross_ref_exist We avoid starting btrfs transaction and get this information from fs_info->running_transaction directly. When accessing running_transaction in check_delayed_ref, there's a chance that current transaction will be freed by commit transaction after the NULL pointer check of running_transaction is passed. After looking all the other places using fs_info->running_transaction, they are either protected by trans_lock or holding the transactions. Fix this by using trans_lock and increasing the use_count. Signed-off-by: ethanwu <ethanwu@synology.com> --- V2: Use refcount_inc rather than aomitc_inc to increase use_count fs/btrfs/extent-tree.c | 7 +++++++ 1 file changed, 7 insertions(+)