On Tue, Feb 24, 2015 at 02:47:05AM -0800, Omar Sandoval wrote: > Consider the following interleaving of overlapping calls to > alloc_extent_buffer: > > Call 1: > > - Successfully allocates a few pages with find_or_create_page > - find_or_create_page fails, goto free_eb > - Unlocks the allocated pages > > Call 2: > - Calls find_or_create_page and gets a page in call 1's extent_buffer > - Finds that the page is already associated with an extent_buffer > - Grabs a reference to the half-written extent_buffer and calls > mark_extent_buffer_accessed on it > > mark_extent_buffer_accessed will then try to call mark_page_accessed on > a null page and panic. > > The fix is to decrement the reference count on the half-written > extent_buffer before unlocking the pages so call 2 won't use it. We > should also set exists = NULL in the case that we don't use exists to > avoid accidentally returning a freed extent_buffer in an error case. > > Signed-off-by: Omar Sandoval <osandov@xxxxxxxxxxx> Reviewed-by: David Sterba <dsterba@xxxxxxx> -- To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
