• Filipe Manana's avatar
    btrfs: fix log context list corruption after rename whiteout error · 236ebc20
    Filipe Manana authored
    During a rename whiteout, if btrfs_whiteout_for_rename() returns an error
    we can end up returning from btrfs_rename() with the log context object
    still in the root's log context list - this happens if 'sync_log' was
    set to true before we called btrfs_whiteout_for_rename() and it is
    dangerous because we end up with a corrupt linked list (root->log_ctxs)
    as the log context object was allocated on the stack.
    
    After btrfs_rename() returns, any task that is running btrfs_sync_log()
    concurrently can end up crashing because that linked list is traversed by
    btrfs_sync_log() (through btrfs_remove_all_log_ctxs()). That results in
    the same issue that commit e6c61710 ("Btrfs: fix log context list
    corruption after rename exchange operation") fixed.
    
    Fixes: d4682ba0 ("Btrfs: sync log after logging new name")
    CC: stable@vger.kernel.org # 4.19+
    Signed-off-by: default avatarFilipe Manana <fdmanana@suse.com>
    Signed-off-by: default avatarDavid Sterba <dsterba@suse.com>
    236ebc20
inode.c 288 KB