From 5119cfc36f6da62ee7c8f38208afece006a27fcb Mon Sep 17 00:00:00 2001 From: Josef Bacik Date: Fri, 24 Jan 2020 09:32:50 -0500 Subject: [PATCH] btrfs: hold a ref on the root in create_pending_snapshot We create the snapshot and then use it for a bunch of things, we need to hold a ref on it while we're messing with it. Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba --- fs/btrfs/ioctl.c | 1 + fs/btrfs/transaction.c | 6 ++++++ 2 files changed, 7 insertions(+) diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c index 5fde22db1727..f36aa0674ade 100644 --- a/fs/btrfs/ioctl.c +++ b/fs/btrfs/ioctl.c @@ -875,6 +875,7 @@ static int create_snapshot(struct btrfs_root *root, struct inode *dir, d_instantiate(dentry, inode); ret = 0; fail: + btrfs_put_fs_root(pending_snapshot->snap); btrfs_subvolume_release_metadata(fs_info, &pending_snapshot->block_rsv); dec_and_free: if (snapshot_force_cow) diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c index bcf23b06e67f..3fa2e7d52eda 100644 --- a/fs/btrfs/transaction.c +++ b/fs/btrfs/transaction.c @@ -1639,6 +1639,12 @@ static noinline int create_pending_snapshot(struct btrfs_trans_handle *trans, btrfs_abort_transaction(trans, ret); goto fail; } + if (!btrfs_grab_fs_root(pending->snap)) { + ret = -ENOENT; + pending->snap = NULL; + btrfs_abort_transaction(trans, ret); + goto fail; + } ret = btrfs_reloc_post_snapshot(trans, pending); if (ret) {