Revision b5de8d0df80fa87f1f97fbcc4bbc8cad0a018802 authored by Filipe Manana on 27 May 2016, 21:21:27 UTC, committed by Filipe Manana on 31 May 2016, 00:00:03 UTC
While we are finishing a device replace operation we can have a concurrent
task trying to do a read repair operation, in which case it will call
btrfs_map_block() to get a struct btrfs_bio which can have a stripe that
points to the source device of the device replace operation. This allows
for the read repair task to dereference the stripe's device pointer after
the device replace operation has freed the source device, resulting in
an invalid memory access. This is similar to the problem solved by my
previous patch in the same series and named "Btrfs: fix race between
device replace and discard".

So fix this by surrounding the call to btrfs_map_block() and the code
that uses the returned struct btrfs_bio with calls to
btrfs_bio_counter_inc_blocked() and btrfs_bio_counter_dec(), giving the
proper serialization with the finishing phase of the device replace
operation.

Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: Josef Bacik <jbacik@fb.com>
1 parent 2999241
History
File Mode Size
Documentation
arch
block
certs
crypto
drivers
firmware
fs
include
init
ipc
kernel
lib
mm
net
samples
scripts
security
sound
tools
usr
virt
.get_maintainer.ignore -rw-r--r-- 31 bytes
.gitignore -rw-r--r-- 1.2 KB
.mailmap -rw-r--r-- 5.8 KB
COPYING -rw-r--r-- 18.3 KB
CREDITS -rw-r--r-- 95.4 KB
Kbuild -rw-r--r-- 2.6 KB
Kconfig -rw-r--r-- 252 bytes
MAINTAINERS -rw-r--r-- 344.5 KB
Makefile -rw-r--r-- 55.0 KB
README -rw-r--r-- 18.1 KB
REPORTING-BUGS -rw-r--r-- 7.3 KB

README

back to top