On Thu, Oct 18, 2018 at 07:17:27PM +0800, Qu Wenruo wrote:
> +void btrfs_qgroup_clean_swapped_blocks(struct btrfs_root *root)
> +{
> + struct btrfs_qgroup_swapped_blocks *swapped_blocks;
> + struct btrfs_qgroup_swapped_block *cur, *next;
> + int i;
> +
> + swapped_blocks = &root->swapped_blocks;
> +
> + spin_lock(&swapped_blocks->lock);
> + if (!swapped_blocks->swapped)
> + goto out;
> + for (i = 0; i < BTRFS_MAX_LEVEL; i++) {
> + struct rb_root *cur_root = &swapped_blocks->blocks[i];
> +
> + rbtree_postorder_for_each_entry_safe(cur, next, cur_root,
> + node) {
> + rb_erase(&cur->node, cur_root);
https://elixir.bootlin.com/linux/latest/source/include/linux/rbtree.h#L141
rb_erase must not be used on the same pointer that
rbtree_postorder_for_each_entry_safe iterates, here it's cur.
