Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 998ac6d2 authored by ethanwu's avatar ethanwu Committed by David Sterba
Browse files

btrfs: Take trans lock before access running trans in check_delayed_ref 



In preivous patch:
Btrfs: kill trans in run_delalloc_nocow and btrfs_cross_ref_exist
We avoid starting btrfs transaction and get this information from
fs_info->running_transaction directly.

When accessing running_transaction in check_delayed_ref, there's a
chance that current transaction will be freed by commit transaction
after the NULL pointer check of running_transaction is passed.

After looking all the other places using fs_info->running_transaction,
they are either protected by trans_lock or holding the transactions.

Fix this by using trans_lock and increasing the use_count.

Fixes: e4c3b2dc ("Btrfs: kill trans in run_delalloc_nocow and btrfs_cross_ref_exist")
CC: stable@vger.kernel.org # 4.14+
Signed-off-by: default avatarethanwu <ethanwu@synology.com>
Signed-off-by: default avatarDavid Sterba <dsterba@suse.com>
parent 17515f1b

fs/btrfs/extent-tree.c

+7 −0
Original line number Diff line number Diff line
@@ -3142,7 +3142,11 @@ static noinline int check_delayed_ref(struct btrfs_root *root, 
	struct rb_node *node;

	int ret = 0;



	spin_lock(&root->fs_info->trans_lock);

	cur_trans = root->fs_info->running_transaction;

	if (cur_trans)

		refcount_inc(&cur_trans->use_count);

	spin_unlock(&root->fs_info->trans_lock);

	if (!cur_trans)

		return 0;
@@ -3151,6 +3155,7 @@ static noinline int check_delayed_ref(struct btrfs_root *root, 
	head = btrfs_find_delayed_ref_head(delayed_refs, bytenr);

	if (!head) {

		spin_unlock(&delayed_refs->lock);

		btrfs_put_transaction(cur_trans);

		return 0;

	}
@@ -3167,6 +3172,7 @@ static noinline int check_delayed_ref(struct btrfs_root *root, 
		mutex_lock(&head->mutex);

		mutex_unlock(&head->mutex);

		btrfs_put_delayed_ref_head(head);

		btrfs_put_transaction(cur_trans);

		return -EAGAIN;

	}

	spin_unlock(&delayed_refs->lock);
@@ -3199,6 +3205,7 @@ static noinline int check_delayed_ref(struct btrfs_root *root, 
	}

	spin_unlock(&head->lock);

	mutex_unlock(&head->mutex);

	btrfs_put_transaction(cur_trans);

	return ret;

}