btrfs: Take trans lock before access running trans in check_delayed_ref
commitpull/10/head998ac6d21c
upstream. In preivous patch: Btrfs: kill trans in run_delalloc_nocow and btrfs_cross_ref_exist We avoid starting btrfs transaction and get this information from fs_info->running_transaction directly. When accessing running_transaction in check_delayed_ref, there's a chance that current transaction will be freed by commit transaction after the NULL pointer check of running_transaction is passed. After looking all the other places using fs_info->running_transaction, they are either protected by trans_lock or holding the transactions. Fix this by using trans_lock and increasing the use_count. Fixes:e4c3b2dcd1
("Btrfs: kill trans in run_delalloc_nocow and btrfs_cross_ref_exist") CC: stable@vger.kernel.org # 4.14+ Signed-off-by: ethanwu <ethanwu@synology.com> Signed-off-by: David Sterba <dsterba@suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
parent
d2d85f8d22
commit
b0e5b437ec
|
@ -3171,7 +3171,11 @@ static noinline int check_delayed_ref(struct btrfs_root *root,
|
|||
struct btrfs_transaction *cur_trans;
|
||||
int ret = 0;
|
||||
|
||||
spin_lock(&root->fs_info->trans_lock);
|
||||
cur_trans = root->fs_info->running_transaction;
|
||||
if (cur_trans)
|
||||
refcount_inc(&cur_trans->use_count);
|
||||
spin_unlock(&root->fs_info->trans_lock);
|
||||
if (!cur_trans)
|
||||
return 0;
|
||||
|
||||
|
@ -3180,6 +3184,7 @@ static noinline int check_delayed_ref(struct btrfs_root *root,
|
|||
head = btrfs_find_delayed_ref_head(delayed_refs, bytenr);
|
||||
if (!head) {
|
||||
spin_unlock(&delayed_refs->lock);
|
||||
btrfs_put_transaction(cur_trans);
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
@ -3196,6 +3201,7 @@ static noinline int check_delayed_ref(struct btrfs_root *root,
|
|||
mutex_lock(&head->mutex);
|
||||
mutex_unlock(&head->mutex);
|
||||
btrfs_put_delayed_ref(&head->node);
|
||||
btrfs_put_transaction(cur_trans);
|
||||
return -EAGAIN;
|
||||
}
|
||||
spin_unlock(&delayed_refs->lock);
|
||||
|
@ -3223,6 +3229,7 @@ static noinline int check_delayed_ref(struct btrfs_root *root,
|
|||
}
|
||||
spin_unlock(&head->lock);
|
||||
mutex_unlock(&head->mutex);
|
||||
btrfs_put_transaction(cur_trans);
|
||||
return ret;
|
||||
}
|
||||
|
||||
|
|
Loading…
Reference in New Issue