Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c7f895a2 authored by Xiao Guangrong's avatar Xiao Guangrong Committed by Chris Mason
Browse files

Btrfs: fix unsafe usage of merge_state 



merge_state can free the current state if it can be merged with the next node,
but in set_extent_bit(), after merge_state, we still use the current extent to
get the next node and cache it into cached_state

Signed-off-by: default avatarXiao Guangrong <xiaoguangrong@cn.fujitsu.com>
Signed-off-by: default avatarChris Mason <chris.mason@oracle.com>
parent 8233767a

fs/btrfs/extent_io.c

+14 −8
Original line number Diff line number Diff line
@@ -780,21 +780,19 @@ hit_next: 
		if (err)

			goto out;



		next_node = rb_next(node);

		cache_state(state, cached_state);

		merge_state(tree, state);

		if (last_end == (u64)-1)

			goto out;



		start = last_end + 1;

		if (start < end && prealloc && !need_resched()) {

			next_node = rb_next(node);

			if (next_node) {

		if (next_node && start < end && prealloc && !need_resched()) {

			state = rb_entry(next_node, struct extent_state,

					 rb_node);

			if (state->start == start)

				goto hit_next;

		}

		}

		goto search_again;

	}
@@ -856,14 +854,22 @@ hit_next: 


		prealloc = alloc_extent_state_atomic(prealloc);

		BUG_ON(!prealloc);



		/*

		 * Avoid to free 'prealloc' if it can be merged with

		 * the later extent.

		 */

		atomic_inc(&prealloc->refs);

		err = insert_state(tree, prealloc, start, this_end,

				   &bits);

		BUG_ON(err == -EEXIST);

		if (err) {

			free_extent_state(prealloc);

			prealloc = NULL;

			goto out;

		}

		cache_state(prealloc, cached_state);

		free_extent_state(prealloc);

		prealloc = NULL;

		start = this_end + 1;

		goto search_again;