Omar Sandoval 5ca64f45e9 btrfs: fix race on ENOMEM in alloc_extent_buffer ... Consider the following interleaving of overlapping calls to alloc_extent_buffer: Call 1: - Successfully allocates a few pages with find_or_create_page - find_or_create_page fails, goto free_eb - Unlocks the allocated pages Call 2: - Calls find_or_create_page and gets a page in call 1's extent_buffer - Finds that the page is already associated with an extent_buffer - Grabs a reference to the half-written extent_buffer and calls mark_extent_buffer_accessed on it mark_extent_buffer_accessed will then try to call mark_page_accessed on a null page and panic. The fix is to decrement the reference count on the half-written extent_buffer before unlocking the pages so call 2 won't use it. We should also set exists = NULL in the case that we don't use exists to avoid accidentally returning a freed extent_buffer in an error case. Signed-off-by: Omar Sandoval <osandov@osandov.com> Reviewed-by: David Sterba <dsterba@suse.cz> Reviewed-by: Liu Bo <bo.li.liu@oracle.com> Signed-off-by: Chris Mason <clm@fb.com>		2015-04-26 06:27:00 -07:00
..
tests	Btrfs: qgroup: cleanup, remove an unsued parameter in btrfs_create_qgroup().	2015-04-13 07:52:44 -07:00
acl.c	btrfs: remove useless ACL check	2014-06-09 17:20:42 -07:00
async-thread.c	btrfs: use correct type for workqueue flags	2015-02-16 18:48:47 +01:00
async-thread.h	btrfs: use correct type for workqueue flags	2015-02-16 18:48:47 +01:00
backref.c	btrfs: use explicit initializer for seq_elem	2015-03-03 17:23:59 +01:00
backref.h	btrfs: cleanup, remove inode_item_info helper	2015-01-14 19:23:47 +01:00
btrfs_inode.h	Btrfs: fix metadata inconsistencies after directory fsync	2015-03-26 17:56:23 -07:00
check-integrity.c	Merge branch 'cleanups-post-3.19' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux into for-linus-4.1	2015-03-25 10:52:48 -07:00
check-integrity.h	block: submit_bio_wait() conversions	2013-11-24 16:33:41 -07:00
compression.c	Merge branch 'cleanups-post-3.19' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux into for-linus-4.1	2015-03-25 10:52:48 -07:00
compression.h	btrfs: constify structs with op functions or static definitions	2015-02-16 18:48:44 +01:00
ctree.c	Merge branch 'cleanups-post-3.19' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux into for-linus-4.1	2015-03-25 10:52:48 -07:00
ctree.h	btrfs: Don't allow subvolid >= (1 << BTRFS_QGROUP_LEVEL_SHIFT) to be created	2015-04-13 07:52:54 -07:00
delayed-inode.c	Btrfs: delayed-inode: replace root args iff only fs_info used	2015-02-16 18:48:43 +01:00
delayed-inode.h	Btrfs: introduce the delayed inode ref deletion for the single link inode	2014-01-28 13:20:09 -08:00
delayed-ref.c	Btrfs: account for crcs in delayed ref processing	2015-04-10 14:04:47 -07:00
delayed-ref.h	Btrfs: account for crcs in delayed ref processing	2015-04-10 14:04:47 -07:00
dev-replace.c	btrfs: cleanup 64bit/32bit divs, compile time constants	2015-03-03 17:23:57 +01:00
dev-replace.h
dir-item.c	Btrfs: make xattr replace operations atomic	2014-11-20 17:20:07 -08:00
disk-io.c	btrfs: Fix NO_SPACE bug caused by delayed-iput	2015-04-13 07:27:41 -07:00
disk-io.h	Btrfs: disk-io: replace root args iff only fs_info used	2015-02-16 18:48:43 +01:00
export.c	btrfs: kill the key type accessor helpers	2014-09-17 13:37:12 -07:00
export.h
extent-tree.c	btrfs: handle ENOMEM in btrfs_alloc_tree_block	2015-04-26 06:27:00 -07:00
extent_io.c	btrfs: fix race on ENOMEM in alloc_extent_buffer	2015-04-26 06:27:00 -07:00
extent_io.h	btrfs: constify structs with op functions or static definitions	2015-02-16 18:48:44 +01:00
extent_map.c	Btrfs: do not move em to modified list when unpinning	2014-11-21 11:59:54 -08:00
extent_map.h	Btrfs: fix NULL pointer crash when running balance and scrub concurrently	2014-06-19 14:20:55 -07:00
file-item.c	Merge branch 'cleanups-post-3.19' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux into for-linus-4.1	2015-03-25 10:52:48 -07:00
file.c	btrfs: qgroup: do a reservation in a higher level.	2015-04-13 07:52:50 -07:00
free-space-cache.c	Btrfs: prevent list corruption during free space cache processing	2015-04-24 11:52:25 -07:00
free-space-cache.h	Btrfs: allow block group cache writeout outside critical section in commit	2015-04-10 14:07:22 -07:00
hash.c	btrfs: LLVMLinux: Remove VLAIS	2014-10-14 10:51:22 +02:00
hash.h	Btrfs: fix btrfs boot when compiled as built-in	2014-01-28 13:20:31 -08:00
inode-item.c	Btrfs: fix fsync log replay for inodes with a mix of regular refs and extrefs	2015-01-21 18:02:05 -08:00
inode-map.c	Btrfs: allow block group cache writeout outside critical section in commit	2015-04-10 14:07:22 -07:00
inode-map.h
inode.c	btrfs: qgroup: do a reservation in a higher level.	2015-04-13 07:52:50 -07:00
ioctl.c	btrfs: quota: Update quota tree after qgroup relationship change.	2015-04-13 07:53:00 -07:00
Kconfig	rcu: Make SRCU optional by using CONFIG_SRCU	2015-01-06 11:04:29 -08:00
locking.c	btrfs: fix lockups from btrfs_clear_path_blocking	2014-11-19 10:34:35 -08:00
locking.h	btrfs: fix lockups from btrfs_clear_path_blocking	2014-11-19 10:34:35 -08:00
lzo.c	btrfs: constify structs with op functions or static definitions	2015-02-16 18:48:44 +01:00
Makefile	Btrfs: add sanity tests for new qgroup accounting code	2014-06-09 17:20:49 -07:00
math.h	btrfs: cleanup 64bit/32bit divs, compile time constants	2015-03-03 17:23:57 +01:00
ordered-data.c	Btrfs: fix fsync race leading to ordered extent memory leaks	2015-03-02 14:04:44 -08:00
ordered-data.h	Btrfs: collect only the necessary ordered extents on ranged fsync	2014-11-21 11:59:56 -08:00
orphan.c	btrfs: kill the key type accessor helpers	2014-09-17 13:37:12 -07:00
print-tree.c	btrfs: remove parameter blocksize from read_tree_block	2014-10-02 17:14:50 +02:00
print-tree.h	btrfs: make static code static & remove dead code	2013-05-06 15:55:23 -04:00
props.c	btrfs: constify structs with op functions or static definitions	2015-02-16 18:48:44 +01:00
props.h	Btrfs: add support for inode properties	2014-01-28 13:20:24 -08:00
qgroup.c	btrfs: quota: Automatically update related qgroups or mark INCONSISTENT flags when assigning/deleting a qgroup relations.	2015-04-13 07:52:59 -07:00
qgroup.h	btrfs: qgroup: do a reservation in a higher level.	2015-04-13 07:52:50 -07:00
raid56.c	Merge branch 'cleanups-post-3.19' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux into for-linus-4.1	2015-03-25 10:52:48 -07:00
raid56.h	Btrfs: Make raid_map array be inlined in btrfs_bio structure	2015-01-21 18:06:47 -08:00
rcu-string.h
reada.c	Btrfs: add ref_count and free function for btrfs_bio	2015-01-21 18:06:48 -08:00
relocation.c	btrfs: qgroup: do a reservation in a higher level.	2015-04-13 07:52:50 -07:00
root-tree.c	Btrfs: use bitfield instead of integer data type for the some variants in btrfs_root	2014-06-09 17:20:40 -07:00
scrub.c	Merge branch 'cleanups-post-3.19' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux into for-linus-4.1	2015-03-25 10:52:48 -07:00
send.c	Btrfs: incremental send, remove dead code	2015-03-26 17:55:52 -07:00
send.h	btrfs: make static code static & remove dead code	2013-05-06 15:55:23 -04:00
struct-funcs.c
super.c	btrfs: cleanup orphans while looking up default subvolume	2015-03-26 18:10:25 -07:00
sysfs.c	btrfs: constify structs with op functions or static definitions	2015-02-16 18:48:44 +01:00
sysfs.h	btrfs: switch helper macros to static inlines in sysfs.h	2015-03-03 17:24:02 +01:00
transaction.c	Btrfs: allow block group cache writeout outside critical section in commit	2015-04-10 14:07:22 -07:00
transaction.h	Btrfs: allow block group cache writeout outside critical section in commit	2015-04-10 14:07:22 -07:00
tree-defrag.c	Btrfs: use bitfield instead of integer data type for the some variants in btrfs_root	2014-06-09 17:20:40 -07:00
tree-log.c	btrfs: actively run the delayed refs while deleting large files	2015-04-10 14:00:14 -07:00
tree-log.h	Btrfs: fix metadata inconsistencies after directory fsync	2015-03-26 17:56:23 -07:00
ulist.c	Btrfs: do not export ulist functions	2014-01-29 07:06:27 -08:00
ulist.h	Btrfs: Fix memory corruption by ulist_add_merge() on 32bit arch	2014-08-15 07:43:19 -07:00
uuid-tree.c	Btrfs: make btrfs_search_forward return with nodes unlocked	2014-09-17 13:38:02 -07:00
volumes.c	Btrfs: fix find_free_dev_extent() malfunction in case device tree has hole	2015-04-26 06:26:59 -07:00
volumes.h	btrfs: remove unused fs_info arg from btrfs_close_extra_devices()	2015-02-16 18:48:45 +01:00
xattr.c	btrfs: don't accept bare namespace as a valid xattr	2015-03-26 18:10:24 -07:00
xattr.h	btrfs: use generic posix ACL infrastructure	2014-01-25 23:58:18 -05:00
zlib.c	btrfs: constify structs with op functions or static definitions	2015-02-16 18:48:44 +01:00