btrfs: Take trans lock before access running trans in check_delayed_ref (998ac6d2) · Commits · 戴 / test

In preivous patch: Btrfs: kill trans in run_delalloc_nocow and btrfs_cross_ref_exist We avoid starting btrfs transaction and get this information from fs_info->running_transaction directly. When accessing running_transaction in check_delayed_ref, there's a chance that current transaction will be freed by commit transaction after the NULL pointer check of running_transaction is passed. After looking all the other places using fs_info->running_transaction, they are either protected by trans_lock or holding the transactions. Fix this by using trans_lock and increasing the use_count. Fixes: ("Btrfs: kill trans in run_delalloc_nocow and btrfs_cross_ref_exist") CC: stable@vger.kernel.org # 4.14+ Signed-off-by:

ethanwu <ethanwu@synology.com> Signed-off-by:

David Sterba <dsterba@suse.com>

fs/btrfs/extent-tree.c

+7 −0

Original line number	Diff line number	Diff line
		@@ -3142,7 +3142,11 @@ static noinline int check_delayed_ref(struct btrfs_root *root,
		struct rb_node *node;
		int ret = 0;

		spin_lock(&root->fs_info->trans_lock);
		cur_trans = root->fs_info->running_transaction;
		if (cur_trans)
		refcount_inc(&cur_trans->use_count);
		spin_unlock(&root->fs_info->trans_lock);
		if (!cur_trans)
		return 0;

		@@ -3151,6 +3155,7 @@ static noinline int check_delayed_ref(struct btrfs_root *root,
		head = btrfs_find_delayed_ref_head(delayed_refs, bytenr);
		if (!head) {
		spin_unlock(&delayed_refs->lock);
		btrfs_put_transaction(cur_trans);
		return 0;
		}

		@@ -3167,6 +3172,7 @@ static noinline int check_delayed_ref(struct btrfs_root *root,
		mutex_lock(&head->mutex);
		mutex_unlock(&head->mutex);
		btrfs_put_delayed_ref_head(head);
		btrfs_put_transaction(cur_trans);
		return -EAGAIN;
		}
		spin_unlock(&delayed_refs->lock);
		@@ -3199,6 +3205,7 @@ static noinline int check_delayed_ref(struct btrfs_root *root,
		}
		spin_unlock(&head->lock);
		mutex_unlock(&head->mutex);
		btrfs_put_transaction(cur_trans);
		return ret;
		}

Admin message