From patchwork Wed May 15 07:48:15 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Miao Xie X-Patchwork-Id: 2570211 Return-Path: X-Original-To: patchwork-linux-btrfs@patchwork.kernel.org Delivered-To: patchwork-process-083081@patchwork2.kernel.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by patchwork2.kernel.org (Postfix) with ESMTP id 03011DF2A2 for ; Wed, 15 May 2013 07:48:42 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756909Ab3EOHsi (ORCPT ); Wed, 15 May 2013 03:48:38 -0400 Received: from cn.fujitsu.com ([222.73.24.84]:48578 "EHLO song.cn.fujitsu.com" rhost-flags-OK-FAIL-OK-OK) by vger.kernel.org with ESMTP id S1755108Ab3EOHsh (ORCPT ); Wed, 15 May 2013 03:48:37 -0400 X-IronPort-AV: E=Sophos;i="4.87,676,1363104000"; d="scan'208";a="7274574" Received: from unknown (HELO tang.cn.fujitsu.com) ([10.167.250.3]) by song.cn.fujitsu.com with ESMTP; 15 May 2013 15:45:47 +0800 Received: from fnstmail02.fnst.cn.fujitsu.com (tang.cn.fujitsu.com [127.0.0.1]) by tang.cn.fujitsu.com (8.14.3/8.13.1) with ESMTP id r4F7mZM9008127; Wed, 15 May 2013 15:48:35 +0800 Received: from btrfs.fnst.cn.fujitsu.com ([10.167.234.170]) by fnstmail02.fnst.cn.fujitsu.com (Lotus Domino Release 8.5.3) with ESMTP id 2013051515472776-1246901 ; Wed, 15 May 2013 15:47:27 +0800 From: Miao Xie To: linux-btrfs@vger.kernel.org Cc: alex.btrfs@zadarastorage.com Subject: [PATCH 01/17] Btrfs: fix accessing a freed tree root Date: Wed, 15 May 2013 15:48:15 +0800 Message-Id: <1368604111-25073-2-git-send-email-miaox@cn.fujitsu.com> X-Mailer: git-send-email 1.8.1.4 In-Reply-To: <1368604111-25073-1-git-send-email-miaox@cn.fujitsu.com> References: <1368604111-25073-1-git-send-email-miaox@cn.fujitsu.com> X-MIMETrack: Itemize by SMTP Server on mailserver/fnst(Release 8.5.3|September 15, 2011) at 2013/05/15 15:47:27, Serialize by Router on mailserver/fnst(Release 8.5.3|September 15, 2011) at 2013/05/15 15:47:29, Serialize complete at 2013/05/15 15:47:29 Sender: linux-btrfs-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-btrfs@vger.kernel.org inode_tree_del() will move the tree root into the dead root list, and then the tree will be destroyed by the cleaner. So if we remove the delayed node which is cached in the inode after inode_tree_del(), we may access a freed tree root. Fix it. Signed-off-by: Miao Xie --- fs/btrfs/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c index 1669c3b..7f6e78a 100644 --- a/fs/btrfs/inode.c +++ b/fs/btrfs/inode.c @@ -4723,6 +4723,7 @@ void btrfs_evict_inode(struct inode *inode) btrfs_end_transaction(trans, root); btrfs_btree_balance_dirty(root); no_delete: + btrfs_remove_delayed_node(inode); clear_inode(inode); return; } @@ -7978,7 +7979,6 @@ void btrfs_destroy_inode(struct inode *inode) inode_tree_del(inode); btrfs_drop_extent_cache(inode, 0, (u64)-1, 0); free: - btrfs_remove_delayed_node(inode); call_rcu(&inode->i_rcu, btrfs_i_callback); }