On Tue, Mar 10, 2020 at 12:13:53PM +0000, fdmanana@xxxxxxxxxx wrote:
> From: Filipe Manana <fdmanana@xxxxxxxx>
>
> During a rename whiteout, if btrfs_whiteout_for_rename() returns an error
> we can end up returning from btrfs_rename() with the log context object
> still in the root's log context list - this happens if 'sync_log' was
> set to true before we called btrfs_whiteout_for_rename() and it is
> dangerous because we end up with a corrupt linked list (root->log_ctxs)
> as the log context object was allocated on the stack.
>
> After btrfs_rename() returns, any task that is running btrfs_sync_log()
> concurrently can end up crashing because that linked list is traversed by
> btrfs_sync_log() (through btrfs_remove_all_log_ctxs()). That results in
> the same issue that commit e6c617102c7e4 ("Btrfs: fix log context list
> corruption after rename exchange operation") fixed.
>
> Fixes: d4682ba03ef618 ("Btrfs: sync log after logging new name")
> Signed-off-by: Filipe Manana <fdmanana@xxxxxxxx>
Added to misc-next, thanks.
