Commit 998ac6d2 authored by ethanwu's avatar ethanwu Committed by David Sterba

btrfs: Take trans lock before access running trans in check_delayed_ref

In preivous patch:
Btrfs: kill trans in run_delalloc_nocow and btrfs_cross_ref_exist
We avoid starting btrfs transaction and get this information from
fs_info->running_transaction directly.

When accessing running_transaction in check_delayed_ref, there's a
chance that current transaction will be freed by commit transaction
after the NULL pointer check of running_transaction is passed.

After looking all the other places using fs_info->running_transaction,
they are either protected by trans_lock or holding the transactions.

Fix this by using trans_lock and increasing the use_count.

Fixes: e4c3b2dc ("Btrfs: kill trans in run_delalloc_nocow and btrfs_cross_ref_exist")
CC: stable@vger.kernel.org # 4.14+
Signed-off-by: default avatarethanwu <ethanwu@synology.com>
Signed-off-by: default avatarDavid Sterba <dsterba@suse.com>
parent 17515f1b
...@@ -3142,7 +3142,11 @@ static noinline int check_delayed_ref(struct btrfs_root *root, ...@@ -3142,7 +3142,11 @@ static noinline int check_delayed_ref(struct btrfs_root *root,
struct rb_node *node; struct rb_node *node;
int ret = 0; int ret = 0;
spin_lock(&root->fs_info->trans_lock);
cur_trans = root->fs_info->running_transaction; cur_trans = root->fs_info->running_transaction;
if (cur_trans)
refcount_inc(&cur_trans->use_count);
spin_unlock(&root->fs_info->trans_lock);
if (!cur_trans) if (!cur_trans)
return 0; return 0;
...@@ -3151,6 +3155,7 @@ static noinline int check_delayed_ref(struct btrfs_root *root, ...@@ -3151,6 +3155,7 @@ static noinline int check_delayed_ref(struct btrfs_root *root,
head = btrfs_find_delayed_ref_head(delayed_refs, bytenr); head = btrfs_find_delayed_ref_head(delayed_refs, bytenr);
if (!head) { if (!head) {
spin_unlock(&delayed_refs->lock); spin_unlock(&delayed_refs->lock);
btrfs_put_transaction(cur_trans);
return 0; return 0;
} }
...@@ -3167,6 +3172,7 @@ static noinline int check_delayed_ref(struct btrfs_root *root, ...@@ -3167,6 +3172,7 @@ static noinline int check_delayed_ref(struct btrfs_root *root,
mutex_lock(&head->mutex); mutex_lock(&head->mutex);
mutex_unlock(&head->mutex); mutex_unlock(&head->mutex);
btrfs_put_delayed_ref_head(head); btrfs_put_delayed_ref_head(head);
btrfs_put_transaction(cur_trans);
return -EAGAIN; return -EAGAIN;
} }
spin_unlock(&delayed_refs->lock); spin_unlock(&delayed_refs->lock);
...@@ -3199,6 +3205,7 @@ static noinline int check_delayed_ref(struct btrfs_root *root, ...@@ -3199,6 +3205,7 @@ static noinline int check_delayed_ref(struct btrfs_root *root,
} }
spin_unlock(&head->lock); spin_unlock(&head->lock);
mutex_unlock(&head->mutex); mutex_unlock(&head->mutex);
btrfs_put_transaction(cur_trans);
return ret; return ret;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment