btrfs: Transpose btrfs_close_devices/btrfs_mapping_tree_free in close_ctree

Following the introduction of the alloc_state tree, some of the callees
of btrfs_mapping_tree_free will have to interact with the btrfs_device
of the constituent devices. Enable this by moving the code responsible
for freeing devices after the last user (btrfs_mapping_tree_free).
Otherwise the kernel could crash due to use-after-free.

Signed-off-by: Nikolay Borisov <nborisov@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>

diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index de1dcccc7c9d0b3507e7da333f6f5f26507d2cc3..8c10702a3f838598b07b046eff6b0da4ac7445cd 100644 (file)
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -4040,8 +4040,8 @@ void close_ctree(struct btrfs_fs_info *fs_info)
                btrfsic_unmount(fs_info->fs_devices);
 #endif
 
-       btrfs_close_devices(fs_info->fs_devices);
        btrfs_mapping_tree_free(&fs_info->mapping_tree);
+       btrfs_close_devices(fs_info->fs_devices);
 
        percpu_counter_destroy(&fs_info->dirty_metadata_bytes);
        percpu_counter_destroy(&fs_info->delalloc_bytes);