From: Filipe Manana Date: Wed, 26 Nov 2014 15:28:50 +0000 (+0000) Subject: Btrfs: fix invalid block group rbtree access after bg is removed X-Git-Tag: omap-for-v3.19/fixes-rc1~111^2~10 X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=292cbd51ecf85d73195a3e3193937fa770f6ea71;p=pandora-kernel.git Btrfs: fix invalid block group rbtree access after bg is removed If we grab a block group, for example in btrfs_trim_fs(), we will be holding a reference on it but the block group can be removed after we got it (via btrfs_remove_block_group), which means it will no longer be part of the rbtree. However, btrfs_remove_block_group() was only calling rb_erase() which leaves the block group's rb_node left and right child pointers with the same content they had before calling rb_erase. This was dangerous because a call to next_block_group() would access the node's left and right child pointers (via rb_next), which can be no longer valid. Fix this by clearing a block group's node after removing it from the tree, and have next_block_group() do a tree search to get the next block group instead of using rb_next() if our block group was removed. Signed-off-by: Filipe Manana Reviewed-by: Josef Bacik Signed-off-by: Chris Mason --- Reading git-diff-tree failed