[4/6] Btrfs: fix unprotected assignment of the left cursor for device replace

Commit Message

Filipe Manana May 20, 2016, 4:44 a.m. UTC

From: Filipe Manana <[e-mail]>

We were assigning new values to fields of the device replace object
without holding the respective lock after processing each device extent.
This is important for the left cursor field which can be accessed by a
concurrent task running __btrfs_map_block (which, correctly, takes the
device replace lock).
So change these fields while holding the device replace lock.

Signed-off-by: Filipe Manana <[e-mail]>
---
 fs/btrfs/scrub.c | 4 ++++
 1 file changed, 4 insertions(+)

Comments

Josef Bacik May 20, 2016, 3:21 p.m. UTC | #1

On Fri, May 20, 2016 at 12:44 AM,  <[e-mail]> wrote:
> From: Filipe Manana <[e-mail]>
>
> We were assigning new values to fields of the device replace object
> without holding the respective lock after processing each device extent.
> This is important for the left cursor field which can be accessed by a
> concurrent task running __btrfs_map_block (which, correctly, takes the
> device replace lock).
> So change these fields while holding the device replace lock.
>
> Signed-off-by: Filipe Manana <[e-mail]>

Eesh, thanks,

Reviewed-by: Josef Bacik <[e-mail]>
--
To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in
the body of a message to [e-mail]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Patch

diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
index a181b52..a58e0ae 100644
--- a/fs/btrfs/scrub.c
+++ b/fs/btrfs/scrub.c
@@ -3640,9 +3640,11 @@  int scrub_enumerate_chunks(struct scrub_ctx *sctx,
 			break;
 		}
 
+		btrfs_dev_replace_lock(&fs_info->dev_replace, 1);
 		dev_replace->cursor_right = found_key.offset + length;
 		dev_replace->cursor_left = found_key.offset;
 		dev_replace->item_needs_writeback = 1;
+		btrfs_dev_replace_unlock(&fs_info->dev_replace, 1);
 		ret = scrub_chunk(sctx, scrub_dev, chunk_offset, length,
 				  found_key.offset, cache, is_dev_replace);
 
@@ -3716,8 +3718,10 @@  int scrub_enumerate_chunks(struct scrub_ctx *sctx,
 			break;
 		}
 
+		btrfs_dev_replace_lock(&fs_info->dev_replace, 1);
 		dev_replace->cursor_left = dev_replace->cursor_right;
 		dev_replace->item_needs_writeback = 1;
+		btrfs_dev_replace_unlock(&fs_info->dev_replace, 1);
 skip:
 		key.offset = found_key.offset + length;
 		btrfs_release_path(path);