• Robbie Ko's avatar
    Btrfs: fix data bytes_may_use underflow with fallocate due to failed quota reserve · 39ad3173
    Robbie Ko authored
    When doing fallocate, we first add the range to the reserve_list and
    then reserve the quota.  If quota reservation fails, we'll release all
    reserved parts of reserve_list.
    
    However, cur_offset is not updated to indicate that this range is
    already been inserted into the list.  Therefore, the same range is freed
    twice.  Once at list_for_each_entry loop, and once at the end of the
    function.  This will result in WARN_ON on bytes_may_use when we free the
    remaining space.
    
    At the end, under the 'out' label we have a call to:
    
       btrfs_free_reserved_data_space(inode, data_reserved, alloc_start, alloc_end - cur_offset);
    
    The start offset, third argument, should be cur_offset.
    
    Everything from alloc_start to cur_offset was freed by the
    list_for_each_entry_safe_loop.
    
    Fixes: 18513091 ("btrfs: update btrfs_space_info's bytes_may_use timely")
    Reviewed-by: default avatarFilipe Manana <fdmanana@suse.com>
    Signed-off-by: default avatarRobbie Ko <robbieko@synology.com>
    Signed-off-by: default avatarDavid Sterba <dsterba@suse.com>
    39ad3173
file.c 87.3 KB