diff mbox

Btrfs: fix crash of btrfs_release_extent_buffer_page

Message ID 1411482153-14416-1-git-send-email-bo.li.liu@oracle.com (mailing list archive)
State Accepted
Headers show

Commit Message

Liu Bo Sept. 23, 2014, 2:22 p.m. UTC
This is actually inspired by Filipe's patch.  When write_one_eb() fails on
submit_extent_page(), it'll give up writing this eb and mark it with
EXTENT_BUFFER_IOERR.  So if it's not the last page that encounter the failure,
there are some left pages which remain DIRTY, and if a later COW on this eb
happens, ie. eb is COWed and freed, it'd run into BUG_ON in
btrfs_release_extent_buffer_page() for the DIRTY page, ie. BUG_ON(PageDirty(page));

This adds the missing clear_page_dirty_for_io() for the rest pages of eb.

Signed-off-by: Liu Bo <bo.li.liu@oracle.com>
---
 fs/btrfs/extent_io.c | 1 +
 1 file changed, 1 insertion(+)

Comments

Filipe Manana Sept. 23, 2014, 2:36 p.m. UTC | #1
On Tue, Sep 23, 2014 at 3:22 PM, Liu Bo <bo.li.liu@oracle.com> wrote:
> This is actually inspired by Filipe's patch.  When write_one_eb() fails on
> submit_extent_page(), it'll give up writing this eb and mark it with
> EXTENT_BUFFER_IOERR.  So if it's not the last page that encounter the failure,
> there are some left pages which remain DIRTY, and if a later COW on this eb
> happens, ie. eb is COWed and freed, it'd run into BUG_ON in
> btrfs_release_extent_buffer_page() for the DIRTY page, ie. BUG_ON(PageDirty(page));
>
> This adds the missing clear_page_dirty_for_io() for the rest pages of eb.
>
> Signed-off-by: Liu Bo <bo.li.liu@oracle.com>

Looks good.
Thanks.

Reviewed-by: Filipe Manana <fdmanana@suse.com>

> ---
>  fs/btrfs/extent_io.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
> index af0359d..e68a1d9 100644
> --- a/fs/btrfs/extent_io.c
> +++ b/fs/btrfs/extent_io.c
> @@ -3597,6 +3597,7 @@ static noinline_for_stack int write_one_eb(struct extent_buffer *eb,
>         if (unlikely(ret)) {
>                 for (; i < num_pages; i++) {
>                         struct page *p = extent_buffer_page(eb, i);
> +                       clear_page_dirty_for_io(p);
>                         unlock_page(p);
>                 }
>         }
> --
> 1.8.1.4
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index af0359d..e68a1d9 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -3597,6 +3597,7 @@  static noinline_for_stack int write_one_eb(struct extent_buffer *eb,
 	if (unlikely(ret)) {
 		for (; i < num_pages; i++) {
 			struct page *p = extent_buffer_page(eb, i);
+			clear_page_dirty_for_io(p);
 			unlock_page(p);
 		}
 	}