From: Miao Xie <miaox@cn.fujitsu.com>
Date: Wed, 3 Sep 2014 13:35:43 +0000 (+0800)
Subject: Btrfs: fix use-after-free problem of the device during device replace
X-Git-Tag: fixes-against-v3.18-rc2~120^2~41
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=67a2c45ee7f4f250458279a2e1244679c5d9735c;p=pandora-kernel.git

Btrfs: fix use-after-free problem of the device during device replace

The problem is:
	Task0(device scan task)		Task1(device replace task)
	scan_one_device()
	mutex_lock(&uuid_mutex)
	device = find_device()
					mutex_lock(&device_list_mutex)
					lock_chunk()
					rm_and_free_source_device
					unlock_chunk()
					mutex_unlock(&device_list_mutex)
	check device

Destroying the target device if device replace fails also has the same problem.

We fix this problem by locking uuid_mutex during destroying source device or
target device, just like the device remove operation.

It is a temporary solution, we can fix this problem and make the code more
clear by atomic counter in the future.

Signed-off-by: Miao Xie <miaox@cn.fujitsu.com>
Signed-off-by: Chris Mason <clm@fb.com>
---

Reading git-diff-tree failed