Liu Bo 876d2cf141 Btrfs: fix double free of fs root ... I got this warning while mounting a btrfs image, [ 3020.509606] ------------[ cut here ]------------ [ 3020.510107] WARNING: CPU: 3 PID: 5581 at lib/idr.c:1051 ida_remove+0xca/0x190 [ 3020.510853] ida_remove called for id=42 which is not allocated. [ 3020.511466] Modules linked in: [ 3020.511802] CPU: 3 PID: 5581 Comm: mount Not tainted 4.7.0-rc5+ #274 [ 3020.512438] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.8.2-20150714_191134- 04/01/2014 [ 3020.513385] 0000000000000286 0000000021295d86 ffff88006c66b8f0 ffffffff8182ba5a [ 3020.514153] 0000000000000000 0000000000000009 ffff88006c66b930 ffffffff810e0ed7 [ 3020.514928] 0000041b00000000 ffffffff8289a8c0 ffff88007f437880 0000000000000000 [ 3020.515717] Call Trace: [ 3020.515965] [<ffffffff8182ba5a>] dump_stack+0xc9/0x13f [ 3020.516487] [<ffffffff810e0ed7>] __warn+0x147/0x160 [ 3020.517005] [<ffffffff810e0f4f>] warn_slowpath_fmt+0x5f/0x80 [ 3020.517572] [<ffffffff8182e6ca>] ida_remove+0xca/0x190 [ 3020.518075] [<ffffffff813a2bcc>] free_anon_bdev+0x2c/0x60 [ 3020.518609] [<ffffffff81657a9f>] free_fs_root+0x13f/0x160 [ 3020.519138] [<ffffffff8165c679>] btrfs_get_fs_root+0x379/0x3d0 [ 3020.519710] [<ffffffff81e6e975>] ? __mutex_unlock_slowpath+0x155/0x2c0 [ 3020.520366] [<ffffffff816615b1>] open_ctree+0x2e91/0x3200 [ 3020.520965] [<ffffffff8161ede2>] btrfs_mount+0x1322/0x15b0 [ 3020.521536] [<ffffffff81e60e74>] ? kmemleak_alloc_percpu+0x44/0x170 [ 3020.522167] [<ffffffff8115f5e1>] ? lockdep_init_map+0x61/0x210 [ 3020.522780] [<ffffffff813a4f59>] mount_fs+0x49/0x2c0 [ 3020.523305] [<ffffffff813d840c>] vfs_kern_mount+0xac/0x1b0 [ 3020.523872] [<ffffffff8161dee1>] btrfs_mount+0x421/0x15b0 [ 3020.524402] [<ffffffff81e60e74>] ? kmemleak_alloc_percpu+0x44/0x170 [ 3020.525045] [<ffffffff8115f5e1>] ? lockdep_init_map+0x61/0x210 [ 3020.525657] [<ffffffff8115f5e1>] ? lockdep_init_map+0x61/0x210 [ 3020.526289] [<ffffffff813a4f59>] mount_fs+0x49/0x2c0 [ 3020.526803] [<ffffffff813d840c>] vfs_kern_mount+0xac/0x1b0 [ 3020.527365] [<ffffffff813dc27a>] do_mount+0x41a/0x1770 [ 3020.527899] [<ffffffff812e800d>] ? strndup_user+0x6d/0xc0 [ 3020.528447] [<ffffffff812e7f68>] ? memdup_user+0x78/0xb0 [ 3020.528987] [<ffffffff813ddad0>] SyS_mount+0x150/0x160 [ 3020.529493] [<ffffffff81e72b7c>] entry_SYSCALL_64_fastpath+0x1f/0xbd It turns out that we free fs root twice, btrfs_init_fs_root() calls free_anon_bdev(root->anon_dev) and later then btrfs_get_fs_root() cals free_fs_root which does another free_anon_bdev() and it ends up with the above warning. Instead of reset root->anon_dev to 0 after free_anon_bdev(), we can let btrfs_init_fs_root() return directly since its callers have already done the free job by calling free_fs_root(). Signed-off-by: Liu Bo <bo.li.liu@oracle.com> Reviewed-by: David Sterba <dsterba@suse.com> Reviewed-by: Chandan Rajendra <chandan@linux.vnet.ibm.com> Signed-off-by: David Sterba <dsterba@suse.com>		2016-07-26 13:52:25 +02:00
..
tests	Btrfs: fix error return code in btrfs_init_test_fs()	2016-06-23 10:44:39 -07:00
acl.c
async-thread.c
async-thread.h
backref.c	Merge branch 'cleanups-4.7' into for-chris-4.7-20160525	2016-05-25 22:51:03 +02:00
backref.h
btrfs_inode.h	Merge branch 'cleanups-4.7' into for-chris-4.7-20160525	2016-05-25 22:51:03 +02:00
check-integrity.c	btrfs: Use correct format specifier	2016-06-17 18:32:40 +02:00
check-integrity.h
compression.c
compression.h
ctree.c	Btrfs: error out if generic_bin_search get invalid arguments	2016-07-26 13:52:25 +02:00
ctree.h	Btrfs: add tracepoints for flush events	2016-07-07 18:45:53 +02:00
delayed-inode.c	Btrfs: change delayed reservation fallback behavior	2016-07-07 18:45:53 +02:00
delayed-inode.h	Btrfs: fix ->iterate_shared() by upgrading i_rwsem for delayed nodes	2016-06-25 06:20:10 -07:00
delayed-ref.c
delayed-ref.h	btrfs: fix string and comment grammatical issues and typos	2016-05-25 22:35:14 +02:00
dev-replace.c	Merge branch 'cleanups-4.7' into for-chris-4.7-20160525	2016-05-25 22:51:03 +02:00
dev-replace.h
dir-item.c
disk-io.c	Btrfs: fix double free of fs root	2016-07-26 13:52:25 +02:00
disk-io.h	Btrfs: self-tests: Support non-4k page size	2016-06-02 19:23:14 +02:00
export.c
export.h
extent-tree.c	Btrfs: check inconsistence between chunk and block group	2016-07-26 13:52:25 +02:00
extent_io.c	Btrfs: fix error handling in map_private_extent_buffer	2016-06-23 10:44:40 -07:00
extent_io.h	Btrfs: self-tests: Support non-4k page size	2016-06-02 19:23:14 +02:00
extent_map.c	btrfs: fix string and comment grammatical issues and typos	2016-05-25 22:35:14 +02:00
extent_map.h
file-item.c
file.c	Btrfs: fix delalloc accounting after copy_from_user faults	2016-07-21 04:03:40 -07:00
free-space-cache.c	Btrfs: self-tests: Support non-4k page size	2016-06-02 19:23:14 +02:00
free-space-cache.h	btrfs: fix string and comment grammatical issues and typos	2016-05-25 22:35:14 +02:00
free-space-tree.c
free-space-tree.h
hash.c	btrfs: advertise which crc32c implementation is being used at module load	2016-06-06 14:08:28 +02:00
hash.h	btrfs: advertise which crc32c implementation is being used at module load	2016-06-06 14:08:28 +02:00
inode-item.c
inode-map.c
inode-map.h
inode.c	Btrfs: fix callers of btrfs_block_rsv_migrate	2016-07-07 18:45:53 +02:00
ioctl.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2016-05-27 17:14:05 -07:00
Kconfig
locking.c
locking.h
lzo.c
Makefile
math.h
ordered-data.c	btrfs: fix disk_i_size update bug when fallocate() fails	2016-06-23 10:44:41 -07:00
ordered-data.h	Btrfs: fix race setting block group readonly during device replace	2016-05-30 12:58:21 +01:00
orphan.c
print-tree.c
print-tree.h
props.c
props.h
qgroup.c	btrfs: fix string and comment grammatical issues and typos	2016-05-25 22:35:14 +02:00
qgroup.h
raid56.c	btrfs: fix string and comment grammatical issues and typos	2016-05-25 22:35:14 +02:00
raid56.h
rcu-string.h
reada.c	Btrfs: fix race between readahead and device replace/removal	2016-05-30 12:58:18 +01:00
relocation.c	Btrfs: use FLUSH_LIMIT for relocation in reserve_metadata_bytes	2016-07-07 18:45:53 +02:00
root-tree.c	Merge branch 'cleanups-4.7' into for-chris-4.7-20160525	2016-05-25 22:51:03 +02:00
scrub.c	Btrfs: fix race setting block group back to RW mode during device replace	2016-05-30 12:58:24 +01:00
send.c	Merge branch 'cleanups-4.7' into for-chris-4.7-20160525	2016-05-25 22:51:03 +02:00
send.h
struct-funcs.c	btrfs: fix string and comment grammatical issues and typos	2016-05-25 22:35:14 +02:00
super.c	btrfs: avoid blocking open_ctree from cleaner_kthread	2016-06-17 18:32:40 +02:00
sysfs.c	btrfs: add missing bytes_readonly attribute file in sysfs	2016-07-26 13:52:25 +02:00
sysfs.h
transaction.c	Btrfs: track transid for delayed ref flushing	2016-06-22 17:54:18 -07:00
transaction.h	btrfs: account for non-CoW'd blocks in btrfs_abort_transaction	2016-06-17 18:32:40 +02:00
tree-defrag.c
tree-log.c	Merge branch 'for-linus-4.7' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs	2016-06-18 05:57:59 -10:00
tree-log.h
ulist.c	btrfs: fix string and comment grammatical issues and typos	2016-05-25 22:35:14 +02:00
ulist.h
uuid-tree.c
volumes.c	Merge branch 'for-linus-4.7' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs	2016-06-25 08:42:31 -07:00
volumes.h
xattr.c	switch xattr_handler->set() to passing dentry and inode separately	2016-05-27 15:39:43 -04:00
xattr.h
zlib.c