Commit 89042e5a authored May 15, 2013 by Miao Xie Committed by Josef Bacik May 17, 2013

Btrfs: fix accessing a freed tree root



inode_tree_del() will move the tree root into the dead root list, and
then the tree will be destroyed by the cleaner. So if we remove the
delayed node which is cached in the inode after inode_tree_del(),
we may access a freed tree root. Fix it.

Signed-off-by: Miao Xie <miaox@cn.fujitsu.com>
Signed-off-by: Josef Bacik <jbacik@fusionio.com>

parent b9aa55be

fs/btrfs/inode.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -4727,6 +4727,7 @@ void btrfs_evict_inode(struct inode *inode)
		btrfs_end_transaction(trans, root);
		btrfs_btree_balance_dirty(root);
		no_delete:
		btrfs_remove_delayed_node(inode);
		clear_inode(inode);
		return;
		}
		@@ -7982,7 +7983,6 @@ void btrfs_destroy_inode(struct inode *inode)
		inode_tree_del(inode);
		btrfs_drop_extent_cache(inode, 0, (u64)-1, 0);
		free:
		btrfs_remove_delayed_node(inode);
		call_rcu(&inode->i_rcu, btrfs_i_callback);
		}

Admin message