Btrfs: fix crash due to not cleaning up tree log block's dirty bits (1846430c) · Commits · 戴 / test

In cases that the whole fs flips into readonly status due to failures in critical sections, then log tree's blocks are still dirty, and this leads to a crash during umount time, the crash is about use-after-free, umount -> close_ctree -> stop workers -> iput(btree_inode) -> iput_final -> write_inode_now -> ... -> queue job on stop'd workers cc: <stable@vger.kernel.org> v3.12+ Fixes: ("Btrfs: cleanup reserved space when freeing tree log on error") Signed-off-by:

Liu Bo <bo.li.liu@oracle.com> Reviewed-by:

Josef Bacik <jbacik@fb.com> Signed-off-by:

David Sterba <dsterba@suse.com>

fs/btrfs/tree-log.c

+9 −0

Original line number	Diff line number	Diff line
		@@ -2471,6 +2471,9 @@ static noinline int walk_down_log_tree(struct btrfs_trans_handle *trans,
		clean_tree_block(fs_info, next);
		btrfs_wait_tree_block_writeback(next);
		btrfs_tree_unlock(next);
		} else {
		if (test_and_clear_bit(EXTENT_BUFFER_DIRTY, &next->bflags))
		clear_extent_buffer_dirty(next);
		}

		WARN_ON(root_owner !=
		@@ -2551,6 +2554,9 @@ static noinline int walk_up_log_tree(struct btrfs_trans_handle *trans,
		clean_tree_block(fs_info, next);
		btrfs_wait_tree_block_writeback(next);
		btrfs_tree_unlock(next);
		} else {
		if (test_and_clear_bit(EXTENT_BUFFER_DIRTY, &next->bflags))
		clear_extent_buffer_dirty(next);
		}

		WARN_ON(root_owner != BTRFS_TREE_LOG_OBJECTID);
		@@ -2629,6 +2635,9 @@ static int walk_log_tree(struct btrfs_trans_handle *trans,
		clean_tree_block(fs_info, next);
		btrfs_wait_tree_block_writeback(next);
		btrfs_tree_unlock(next);
		} else {
		if (test_and_clear_bit(EXTENT_BUFFER_DIRTY, &next->bflags))
		clear_extent_buffer_dirty(next);
		}

		WARN_ON(log->root_key.objectid !=

Admin message