On Wed, Jun 26, 2013 at 12:02:51PM +0800, Liu Bo wrote: > Several users reported this crash of NULL pointer or general protection, > the story is that we add a rbtree for speedup ulist iteration, and we > use krealloc() to address ulist growth, and krealloc() use memcpy to copy > old data to new memory area, so it's OK for an array as it doesn't use > pointers while it's not OK for a rbtree as it uses pointers. > > So krealloc() will mess up our rbtree and it ends up with crash. > > Signed-off-by: Liu Bo <bo.li.liu@xxxxxxxxxx> > --- > fs/btrfs/ulist.c | 13 ++++++++++++- > 1 files changed, 12 insertions(+), 1 deletions(-) > > diff --git a/fs/btrfs/ulist.c b/fs/btrfs/ulist.c > index 7b417e2..69a9c32 100644 > --- a/fs/btrfs/ulist.c > +++ b/fs/btrfs/ulist.c > @@ -73,7 +73,6 @@ void ulist_fini(struct ulist *ulist) > if (ulist->nodes_alloced > ULIST_SIZE) > kfree(ulist->nodes); > ulist->nodes_alloced = 0; /* in case ulist_fini is called twice */ > - ulist->root = RB_ROOT; Why this change ^^? Josef -- To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
