Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 292cbd51 authored by Filipe Manana's avatar Filipe Manana Committed by Chris Mason
Browse files

Btrfs: fix invalid block group rbtree access after bg is removed 



If we grab a block group, for example in btrfs_trim_fs(), we will be holding
a reference on it but the block group can be removed after we got it (via
btrfs_remove_block_group), which means it will no longer be part of the
rbtree.

However, btrfs_remove_block_group() was only calling rb_erase() which leaves
the block group's rb_node left and right child pointers with the same content
they had before calling rb_erase. This was dangerous because a call to
next_block_group() would access the node's left and right child pointers (via
rb_next), which can be no longer valid.

Fix this by clearing a block group's node after removing it from the tree,
and have next_block_group() do a tree search to get the next block group
instead of using rb_next() if our block group was removed.

Signed-off-by: default avatarFilipe Manana <fdmanana@suse.com>
Reviewed-by: default avatarJosef Bacik <jbacik@fb.com>
Signed-off-by: default avatarChris Mason <clm@fb.com>
parent 9ea24bbe

fs/btrfs/extent-tree.c

+13 −0
Original line number Original line Diff line number Diff line
@@ -3162,7 +3162,19 @@ next_block_group(struct btrfs_root *root, 
		 struct btrfs_block_group_cache *cache)

		 struct btrfs_block_group_cache *cache)

{

{

	struct rb_node *node;

	struct rb_node *node;



	spin_lock(&root->fs_info->block_group_cache_lock);

	spin_lock(&root->fs_info->block_group_cache_lock);



	/* If our block group was removed, we need a full search. */

	if (RB_EMPTY_NODE(&cache->cache_node)) {

		const u64 next_bytenr = cache->key.objectid + cache->key.offset;



		spin_unlock(&root->fs_info->block_group_cache_lock);

		btrfs_put_block_group(cache);

		cache = btrfs_lookup_first_block_group(root->fs_info,

						       next_bytenr);

		return cache;

	}

	node = rb_next(&cache->cache_node);

	node = rb_next(&cache->cache_node);

	btrfs_put_block_group(cache);

	btrfs_put_block_group(cache);

	if (node) {

	if (node) {
@@ -9389,6 +9401,7 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans, 
	spin_lock(&root->fs_info->block_group_cache_lock);

	spin_lock(&root->fs_info->block_group_cache_lock);

	rb_erase(&block_group->cache_node,

	rb_erase(&block_group->cache_node,

		 &root->fs_info->block_group_cache_tree);

		 &root->fs_info->block_group_cache_tree);

	RB_CLEAR_NODE(&block_group->cache_node);





	if (root->fs_info->first_logical_byte == block_group->key.objectid)

	if (root->fs_info->first_logical_byte == block_group->key.objectid)

		root->fs_info->first_logical_byte = (u64)-1;

		root->fs_info->first_logical_byte = (u64)-1;