• Kent Overstreet's avatar
    bcachefs: Fix race between trans_put() and btree_transactions_read() · de611ab6
    Kent Overstreet authored
    debug.c was using closure_get() on a different thread's closure where
    the we don't know if the object being refcounted is alive.
    
    We keep btree_trans objects on a list so they can be printed by debug
    code, and because it is cost prohibitive to touch the btree_trans list
    every time we allocate and free btree_trans objects, cached objects are
    also on this list.
    
    However, we do not want the debug code to see cached but not in use
    btree_trans objects - critically because the btree_paths array will have
    been freed (if it was reallocated).
    
    closure_get() is also incorrect to use when that get may race with it
    hitting zero, i.e. we must already have a ref on the object or know the
    ref can't currently hit 0 for other reasons (as used in the cycle
    detector).
    
    to fix this, use the previously introduced closure_get_not_zero(),
    closure_return_sync(), and closure_init_stack_release(); the debug code
    now can only take a ref on a trans object if it's alive and in use.
    Signed-off-by: default avatarKent Overstreet <kent.overstreet@linux.dev>
    de611ab6
debug.c 21.1 KB