Btrfs: fix unlock after free on rewinded tree blocks

	btrfs_set_header_nritems(eb, n);

}

/*

 * Called with eb read locked. If the buffer cannot be rewinded, the same buffer

 * is returned. If rewind operations happen, a fresh buffer is returned. The

 * returned buffer is always read-locked. If the returned buffer is not the

 * input buffer, the lock on the input buffer is released and the input buffer

 * is freed (its refcount is decremented).

 */

static struct extent_buffer *

tree_mod_log_rewind(struct btrfs_fs_info *fs_info, struct extent_buffer *eb,

		    u64 time_seq)

	}

	extent_buffer_get(eb_rewin);

	btrfs_tree_read_unlock(eb);

	free_extent_buffer(eb);

	extent_buffer_get(eb_rewin);

	btrfs_tree_read_lock(eb_rewin);

	__tree_mod_log_rewind(eb_rewin, time_seq, tm);

	WARN_ON(btrfs_header_nritems(eb_rewin) >

		BTRFS_NODEPTRS_PER_BLOCK(fs_info->tree_root));

				btrfs_clear_path_blocking(p, b,

							  BTRFS_READ_LOCK);

			}

			p->locks[level] = BTRFS_READ_LOCK;

			p->nodes[level] = b;

			b = tree_mod_log_rewind(root->fs_info, b, time_seq);

			if (b != p->nodes[level]) {

				btrfs_tree_unlock_rw(p->nodes[level],

						     p->locks[level]);

				p->locks[level] = 0;

			p->locks[level] = BTRFS_READ_LOCK;

			p->nodes[level] = b;

			}

		} else {

			p->slots[level] = slot;

			unlock_up(p, level, lowest_unlock, 0, NULL);