Commit 85b5d4bc authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'for-4.20-part2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux 

Pull more btrfs updates from David Sterba:
 "This contains a few minor updates and fixes that were under testing or
  arrived shortly after the merge window freeze, mostly stable material"

* tag 'for-4.20-part2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
  Btrfs: fix use-after-free when dumping free space
  Btrfs: fix use-after-free during inode eviction
  btrfs: move the dio_sem higher up the callchain
  btrfs: don't run delayed_iputs in commit
  btrfs: fix insert_reserved error handling
  btrfs: only free reserved extent if we didn't insert it
  btrfs: don't use ctl->free_space for max_extent_size
  btrfs: set max_extent_size properly
  btrfs: reset max_extent_size properly
  MAINTAINERS: update my email address for btrfs
  btrfs: delayed-ref: extract find_first_ref_head from find_ref_head
  Btrfs: fix deadlock when writing out free space caches
  Btrfs: fix assertion on fsync of regular file when using no-holes feature
  Btrfs: fix null pointer dereference on compressed write path error
parents 11743c56 9084cb6a

MAINTAINERS

+1 −1
Original line number Diff line number Diff line
@@ -3160,7 +3160,7 @@ F: drivers/gpio/gpio-bt8xx.c 


BTRFS FILE SYSTEM

M:	Chris Mason <clm@fb.com>

M:	Josef Bacik <jbacik@fb.com>

M:	Josef Bacik <josef@toxicpanda.com>

M:	David Sterba <dsterba@suse.com>

L:	linux-btrfs@vger.kernel.org

W:	http://btrfs.wiki.kernel.org/

fs/btrfs/ctree.c

+17 −0
Original line number Diff line number Diff line
@@ -1014,9 +1014,26 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans, 
	if ((root->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID) && parent)

		parent_start = parent->start;



	/*

	 * If we are COWing a node/leaf from the extent, chunk or device trees,

	 * make sure that we do not finish block group creation of pending block

	 * groups. We do this to avoid a deadlock.

	 * COWing can result in allocation of a new chunk, and flushing pending

	 * block groups (btrfs_create_pending_block_groups()) can be triggered

	 * when finishing allocation of a new chunk. Creation of a pending block

	 * group modifies the extent, chunk and device trees, therefore we could

	 * deadlock with ourselves since we are holding a lock on an extent

	 * buffer that btrfs_create_pending_block_groups() may try to COW later.

	 */

	if (root == fs_info->extent_root ||

	    root == fs_info->chunk_root ||

	    root == fs_info->dev_root)

		trans->can_flush_pending_bgs = false;



	cow = btrfs_alloc_tree_block(trans, root, parent_start,

			root->root_key.objectid, &disk_key, level,

			search_start, empty_size);

	trans->can_flush_pending_bgs = true;

	if (IS_ERR(cow))

		return PTR_ERR(cow);

fs/btrfs/delayed-ref.c

+27 −23
Original line number Diff line number Diff line
@@ -164,12 +164,25 @@ static struct btrfs_delayed_ref_node* tree_insert(struct rb_root_cached *root, 
	return NULL;

}



static struct btrfs_delayed_ref_head *find_first_ref_head(

		struct btrfs_delayed_ref_root *dr)

{

	struct rb_node *n;

	struct btrfs_delayed_ref_head *entry;



	n = rb_first_cached(&dr->href_root);

	if (!n)

		return NULL;



	entry = rb_entry(n, struct btrfs_delayed_ref_head, href_node);



	return entry;

}



/*

 * find an head entry based on bytenr. This returns the delayed ref

 * head if it was able to find one, or NULL if nothing was in that spot.

 * If return_bigger is given, the next bigger entry is returned if no exact

 * match is found. But if no bigger one is found then the first node of the

 * ref head tree will be returned.

 * Find a head entry based on bytenr. This returns the delayed ref head if it

 * was able to find one, or NULL if nothing was in that spot.  If return_bigger

 * is given, the next bigger entry is returned if no exact match is found.

 */

static struct btrfs_delayed_ref_head *find_ref_head(

		struct btrfs_delayed_ref_root *dr, u64 bytenr,
@@ -195,10 +208,9 @@ static struct btrfs_delayed_ref_head* find_ref_head( 
		if (bytenr > entry->bytenr) {

			n = rb_next(&entry->href_node);

			if (!n)

				n = rb_first_cached(&dr->href_root);

				return NULL;

			entry = rb_entry(n, struct btrfs_delayed_ref_head,

					 href_node);

			return entry;

		}

		return entry;

	}
@@ -355,33 +367,25 @@ struct btrfs_delayed_ref_head *btrfs_select_ref_head( 
		struct btrfs_delayed_ref_root *delayed_refs)

{

	struct btrfs_delayed_ref_head *head;

	u64 start;

	bool loop = false;



again:

	start = delayed_refs->run_delayed_start;

	head = find_ref_head(delayed_refs, start, true);

	if (!head && !loop) {

	head = find_ref_head(delayed_refs, delayed_refs->run_delayed_start,

			     true);

	if (!head && delayed_refs->run_delayed_start != 0) {

		delayed_refs->run_delayed_start = 0;

		start = 0;

		loop = true;

		head = find_ref_head(delayed_refs, start, true);

		head = find_first_ref_head(delayed_refs);

	}

	if (!head)

		return NULL;

	} else if (!head && loop) {

		return NULL;

	}



	while (head->processing) {

		struct rb_node *node;



		node = rb_next(&head->href_node);

		if (!node) {

			if (loop)

			if (delayed_refs->run_delayed_start == 0)

				return NULL;

			delayed_refs->run_delayed_start = 0;

			start = 0;

			loop = true;

			goto again;

		}

		head = rb_entry(node, struct btrfs_delayed_ref_head,

fs/btrfs/extent-tree.c

+17 −20
Original line number Diff line number Diff line
@@ -2366,6 +2366,9 @@ static int run_one_delayed_ref(struct btrfs_trans_handle *trans, 
					   insert_reserved);

	else

		BUG();

	if (ret && insert_reserved)

		btrfs_pin_extent(trans->fs_info, node->bytenr,

				 node->num_bytes, 1);

	return ret;

}
@@ -2954,7 +2957,6 @@ int btrfs_run_delayed_refs(struct btrfs_trans_handle *trans, 
	struct btrfs_delayed_ref_head *head;

	int ret;

	int run_all = count == (unsigned long)-1;

	bool can_flush_pending_bgs = trans->can_flush_pending_bgs;



	/* We'll clean this up in btrfs_cleanup_transaction */

	if (trans->aborted)
@@ -2971,7 +2973,6 @@ again: 
#ifdef SCRAMBLE_DELAYED_REFS

	delayed_refs->run_delayed_start = find_middle(&delayed_refs->root);

#endif

	trans->can_flush_pending_bgs = false;

	ret = __btrfs_run_delayed_refs(trans, count);

	if (ret < 0) {

		btrfs_abort_transaction(trans, ret);
@@ -3002,7 +3003,6 @@ again: 
		goto again;

	}

out:

	trans->can_flush_pending_bgs = can_flush_pending_bgs;

	return 0;

}
@@ -4568,6 +4568,7 @@ static int do_chunk_alloc(struct btrfs_trans_handle *trans, u64 flags, 
			goto out;

	} else {

		ret = 1;

		space_info->max_extent_size = 0;

	}



	space_info->force_alloc = CHUNK_ALLOC_NO_FORCE;
@@ -4589,11 +4590,9 @@ out: 
	 * the block groups that were made dirty during the lifetime of the

	 * transaction.

	 */

	if (trans->can_flush_pending_bgs &&

	    trans->chunk_bytes_reserved >= (u64)SZ_2M) {

	if (trans->chunk_bytes_reserved >= (u64)SZ_2M)

		btrfs_create_pending_block_groups(trans);

		btrfs_trans_release_chunk_metadata(trans);

	}



	return ret;

}
@@ -6464,6 +6463,7 @@ static void btrfs_free_reserved_bytes(struct btrfs_block_group_cache *cache, 
		space_info->bytes_readonly += num_bytes;

	cache->reserved -= num_bytes;

	space_info->bytes_reserved -= num_bytes;

	space_info->max_extent_size = 0;



	if (delalloc)

		cache->delalloc_bytes -= num_bytes;
@@ -7260,6 +7260,7 @@ static noinline int find_free_extent(struct btrfs_fs_info *fs_info, 
	struct btrfs_block_group_cache *block_group = NULL;

	u64 search_start = 0;

	u64 max_extent_size = 0;

	u64 max_free_space = 0;

	u64 empty_cluster = 0;

	struct btrfs_space_info *space_info;

	int loop = 0;
@@ -7555,8 +7556,8 @@ unclustered_alloc: 
			spin_lock(&ctl->tree_lock);

			if (ctl->free_space <

			    num_bytes + empty_cluster + empty_size) {

				if (ctl->free_space > max_extent_size)

					max_extent_size = ctl->free_space;

				max_free_space = max(max_free_space,

						     ctl->free_space);

				spin_unlock(&ctl->tree_lock);

				goto loop;

			}
@@ -7723,6 +7724,8 @@ loop: 
	}

out:

	if (ret == -ENOSPC) {

		if (!max_extent_size)

			max_extent_size = max_free_space;

		spin_lock(&space_info->lock);

		space_info->max_extent_size = max_extent_size;

		spin_unlock(&space_info->lock);
@@ -8004,21 +8007,14 @@ static int alloc_reserved_tree_block(struct btrfs_trans_handle *trans, 
	}



	path = btrfs_alloc_path();

	if (!path) {

		btrfs_free_and_pin_reserved_extent(fs_info,

						   extent_key.objectid,

						   fs_info->nodesize);

	if (!path)

		return -ENOMEM;

	}



	path->leave_spinning = 1;

	ret = btrfs_insert_empty_item(trans, fs_info->extent_root, path,

				      &extent_key, size);

	if (ret) {

		btrfs_free_path(path);

		btrfs_free_and_pin_reserved_extent(fs_info,

						   extent_key.objectid,

						   fs_info->nodesize);

		return ret;

	}
@@ -10132,9 +10128,10 @@ void btrfs_create_pending_block_groups(struct btrfs_trans_handle *trans) 
	struct btrfs_block_group_item item;

	struct btrfs_key key;

	int ret = 0;

	bool can_flush_pending_bgs = trans->can_flush_pending_bgs;



	trans->can_flush_pending_bgs = false;

	if (!trans->can_flush_pending_bgs)

		return;



	while (!list_empty(&trans->new_bgs)) {

		block_group = list_first_entry(&trans->new_bgs,

					       struct btrfs_block_group_cache,
@@ -10159,7 +10156,7 @@ void btrfs_create_pending_block_groups(struct btrfs_trans_handle *trans) 
next:

		list_del_init(&block_group->bg_list);

	}

	trans->can_flush_pending_bgs = can_flush_pending_bgs;

	btrfs_trans_release_chunk_metadata(trans);

}



int btrfs_make_block_group(struct btrfs_trans_handle *trans, u64 bytes_used,

fs/btrfs/file.c

+12 −0
Original line number Diff line number Diff line
@@ -2078,6 +2078,14 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync) 
		goto out;



	inode_lock(inode);



	/*

	 * We take the dio_sem here because the tree log stuff can race with

	 * lockless dio writes and get an extent map logged for an extent we

	 * never waited on.  We need it this high up for lockdep reasons.

	 */

	down_write(&BTRFS_I(inode)->dio_sem);



	atomic_inc(&root->log_batch);



	/*
@@ -2086,6 +2094,7 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync) 
	 */

	ret = btrfs_wait_ordered_range(inode, start, len);

	if (ret) {

		up_write(&BTRFS_I(inode)->dio_sem);

		inode_unlock(inode);

		goto out;

	}
@@ -2109,6 +2118,7 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync) 
		 * checked called fsync.

		 */

		ret = filemap_check_wb_err(inode->i_mapping, file->f_wb_err);

		up_write(&BTRFS_I(inode)->dio_sem);

		inode_unlock(inode);

		goto out;

	}
@@ -2127,6 +2137,7 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync) 
	trans = btrfs_start_transaction(root, 0);

	if (IS_ERR(trans)) {

		ret = PTR_ERR(trans);

		up_write(&BTRFS_I(inode)->dio_sem);

		inode_unlock(inode);

		goto out;

	}
@@ -2148,6 +2159,7 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync) 
	 * file again, but that will end up using the synchronization

	 * inside btrfs_sync_log to keep things safe.

	 */

	up_write(&BTRFS_I(inode)->dio_sem);

	inode_unlock(inode);



	/*

CRA Git | Maintained and supported by SUSTech CRA and CCSE