Nikolay Borisov 537f38f019 btrfs: Correctly free extent buffer in case btree_read_extent_buffer_pages fails ... If a an eb fails to be read for whatever reason - it's corrupted on disk and parent transid/key validations fail or IO for eb pages fail then this buffer must be removed from the buffer cache. Currently the code calls free_extent_buffer if an error occurs. Unfortunately this doesn't achieve the desired behavior since btrfs_find_create_tree_block returns with eb->refs == 2. On the other hand free_extent_buffer will only decrement the refs once leaving it added to the buffer cache radix tree. This enables later code to look up the buffer from the cache and utilize it potentially leading to a crash. The correct way to free the buffer is call free_extent_buffer_stale. This function will correctly call atomic_dec explicitly for the buffer and subsequently call release_extent_buffer which will decrement the final reference thus correctly remove the invalid buffer from buffer cache. This change affects only newly allocated buffers since they have eb->refs == 2. Link: https://bugzilla.kernel.org/show_bug.cgi?id=202755 Reported-by: Jungyeon <jungyeon@gatech.edu> CC: stable@vger.kernel.org # 4.4+ Signed-off-by: Nikolay Borisov <nborisov@suse.com> Reviewed-by: David Sterba <dsterba@suse.com> Signed-off-by: David Sterba <dsterba@suse.com>		2019-04-29 19:02:22 +02:00
..
tests	btrfs: Introduce extent_io_tree::owner to distinguish different io_trees	2019-04-29 19:02:18 +02:00
Kconfig	…
Makefile	…
acl.c	Btrfs: setup a nofs context for memory allocation at __btrfs_set_acl	2019-02-25 14:13:17 +01:00
async-thread.c	btrfs: simplify workqueue name when allocating	2019-02-25 14:13:24 +01:00
async-thread.h	…
backref.c	btrfs: honor path->skip_locking in backref code	2019-02-25 14:13:39 +01:00
backref.h	…
btrfs_inode.h	Btrfs: fix fsync of files with multiple hard links in new directories	2018-12-17 14:51:43 +01:00
check-integrity.c	btrfs: Fix typos in comments and strings	2018-12-17 14:51:50 +01:00
check-integrity.h	…
compression.c	for-5.1/block-20190302	2019-03-08 14:12:17 -08:00
compression.h	btrfs: change set_level() to bound the level passed in	2019-02-25 14:13:32 +01:00
ctree.c	Btrfs: remove assertion when searching for a key in a node/leaf	2019-02-25 14:19:23 +01:00
ctree.h	btrfs: Make btrfs_(set|clear)_header_flag return void	2019-04-29 19:02:22 +02:00
dedupe.h	…
delayed-inode.c	…
delayed-inode.h	…
delayed-ref.c	btrfs: qgroup: Move reserved data accounting from btrfs_delayed_ref_head to btrfs_qgroup_extent_record	2019-02-25 14:13:39 +01:00
delayed-ref.h	btrfs: qgroup: Move reserved data accounting from btrfs_delayed_ref_head to btrfs_qgroup_extent_record	2019-02-25 14:13:39 +01:00
dev-replace.c	btrfs: drop the lock on error in btrfs_dev_replace_cancel	2019-02-25 14:13:41 +01:00
dev-replace.h	btrfs: dev-replace: open code trivial locking helpers	2018-12-17 14:51:45 +01:00
dir-item.c	…
disk-io.c	btrfs: Correctly free extent buffer in case btree_read_extent_buffer_pages fails	2019-04-29 19:02:22 +02:00
disk-io.h	btrfs: drop extra enum initialization where using defaults	2018-12-17 14:51:43 +01:00
export.c	…
export.h	…
extent-tree.c	Btrfs: remove no longer used 'sync' member from transaction handle	2019-04-29 19:02:18 +02:00
extent_io.c	btrfs: Remove unused -EIO assignment in end_bio_extent_readpage	2019-04-29 19:02:22 +02:00
extent_io.h	btrfs: switch extent_buffer::lock_nested to bool	2019-04-29 19:02:21 +02:00
extent_map.c	btrfs: Remove impossible condition from mergable_maps	2019-02-25 14:13:21 +01:00
extent_map.h	btrfs: Remove impossible condition from mergable_maps	2019-02-25 14:13:21 +01:00
file-item.c	btrfs: reduce kmap_atomic time for checksumming	2019-04-29 19:02:19 +02:00
file.c	Btrfs: remove no longer used 'sync' member from transaction handle	2019-04-29 19:02:18 +02:00
free-space-cache.c	…
free-space-cache.h	…
free-space-tree.c	btrfs: use EXPORT_FOR_TESTS for conditionally exported functions	2018-12-17 14:51:37 +01:00
free-space-tree.h	…
inode-item.c	…
inode-map.c	…
inode-map.h	…
inode.c	btrfs: Introduce extent_io_tree::owner to distinguish different io_trees	2019-04-29 19:02:18 +02:00
ioctl.c	btrfs: refactor btrfs_set_prop and add btrfs_set_prop_trans	2019-04-29 19:02:19 +02:00
locking.c	btrfs: switch extent_buffer::lock_nested to bool	2019-04-29 19:02:21 +02:00
locking.h	btrfs: merge btrfs_set_lock_blocking_rw with it's caller	2019-02-25 14:13:28 +01:00
lzo.c	btrfs: change set_level() to bound the level passed in	2019-02-25 14:13:32 +01:00
math.h	…
ordered-data.c	btrfs: Switch memory allocations in async csum calculation path to kvmalloc	2019-04-25 14:17:38 +02:00
ordered-data.h	btrfs: switch BTRFS_ORDERED_* to enums	2018-12-17 14:51:43 +01:00
orphan.c	…
print-tree.c	…
print-tree.h	…
props.c	btrfs: refactor btrfs_set_prop and add btrfs_set_prop_trans	2019-04-29 19:02:19 +02:00
props.h	btrfs: refactor btrfs_set_prop and add btrfs_set_prop_trans	2019-04-29 19:02:19 +02:00
qgroup.c	btrfs: Fix bound checking in qgroup_trace_new_subtree_blocks	2019-03-19 14:12:31 +01:00
qgroup.h	btrfs: qgroup: Move reserved data accounting from btrfs_delayed_ref_head to btrfs_qgroup_extent_record	2019-02-25 14:13:39 +01:00
raid56.c	for-5.1-rc2-tag	2019-03-26 10:32:13 -07:00
raid56.h	…
rcu-string.h	…
reada.c	btrfs: dev-replace: open code trivial locking helpers	2018-12-17 14:51:45 +01:00
ref-verify.c	btrfs: replace btrfs_set_lock_blocking_rw with appropriate helpers	2019-02-25 14:13:27 +01:00
ref-verify.h	…
relocation.c	btrfs: reloc: Fix NULL pointer dereference due to expanded reloc_root lifespan	2019-04-29 19:02:22 +02:00
root-tree.c	btrfs: Don't panic when we can't find a root key	2019-04-29 19:02:17 +02:00
scrub.c	btrfs: scrub: return EAGAIN when fs is closing	2019-04-29 19:02:17 +02:00
send.c	Remove 'type' argument from access_ok() function	2019-01-03 18:57:57 -08:00
send.h	…
struct-funcs.c	…
super.c	btrfs: add zstd compression level support	2019-02-25 14:13:33 +01:00
sysfs.c	btrfs: Add sysfs support for metadata_uuid feature	2018-12-17 14:51:37 +01:00
sysfs.h	btrfs: drop extra enum initialization where using defaults	2018-12-17 14:51:43 +01:00
transaction.c	btrfs: Introduce extent_io_tree::owner to distinguish different io_trees	2019-04-29 19:02:18 +02:00
transaction.h	Btrfs: remove no longer used 'sync' member from transaction handle	2019-04-29 19:02:18 +02:00
tree-checker.c	btrfs: Fix typos in comments and strings	2018-12-17 14:51:50 +01:00
tree-checker.h	…
tree-defrag.c	btrfs: open code now trivial btrfs_set_lock_blocking	2019-02-25 14:13:27 +01:00
tree-log.c	Btrfs: fix assertion failure on fsync with NO_HOLES enabled	2019-03-20 19:53:39 +01:00
tree-log.h	Btrfs: remove no longer used io_err from btrfs_log_ctx	2018-12-17 14:51:31 +01:00
ulist.c	…
ulist.h	…
uuid-tree.c	btrfs: Turn an 'else if' into an 'else' in btrfs_uuid_tree_add	2019-04-29 19:02:19 +02:00
volumes.c	btrfs: don't report readahead errors and don't update statistics	2019-03-13 17:14:27 +01:00
volumes.h	btrfs: introduce new ioctl to unregister a btrfs device	2019-02-25 14:13:30 +01:00
xattr.c	btrfs: refactor btrfs_set_prop and add btrfs_set_prop_trans	2019-04-29 19:02:19 +02:00
xattr.h	…
zlib.c	btrfs: change set_level() to bound the level passed in	2019-02-25 14:13:32 +01:00
zstd.c	btrfs: zstd: remove indirect calls for local functions	2019-04-29 19:02:18 +02:00