From: Josef Bacik Date: Fri, 13 Mar 2020 15:44:46 +0000 (-0400) Subject: btrfs: clear DEAD_RELOC_TREE before dropping the reloc root X-Git-Url: http://git.lede-project.org./?a=commitdiff_plain;h=f28de8d8fd376ba57aaed53cdc1a0ba2238e8ebf;p=openwrt%2Fstaging%2Fblogic.git btrfs: clear DEAD_RELOC_TREE before dropping the reloc root The DEAD_RELOC_TREE flag is in place in order to avoid a use after free in init_reloc_root, tracking the presence of reloc_root. However adding the explicit tree references in previous patches makes the use after free impossible because at this point we no longer have a reloc_control set on the fs_info and thus cannot enter the function. So move this to be coupled with clearing the root->reloc_root so we're consistent with all other operations of the reloc root. Signed-off-by: Josef Bacik Reviewed-by: David Sterba [ update changelog ] Signed-off-by: David Sterba --- diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c index a0c8f7949a19..54724ae45380 100644 --- a/fs/btrfs/relocation.c +++ b/fs/btrfs/relocation.c @@ -2275,18 +2275,18 @@ static int clean_dirty_subvols(struct reloc_control *rc) list_del_init(&root->reloc_dirty_list); root->reloc_root = NULL; - if (reloc_root) { - - ret2 = btrfs_drop_snapshot(reloc_root, 0, 1); - if (ret2 < 0 && !ret) - ret = ret2; - } /* * Need barrier to ensure clear_bit() only happens after * root->reloc_root = NULL. Pairs with have_reloc_root. */ smp_wmb(); clear_bit(BTRFS_ROOT_DEAD_RELOC_TREE, &root->state); + + if (reloc_root) { + ret2 = btrfs_drop_snapshot(reloc_root, 0, 1); + if (ret2 < 0 && !ret) + ret = ret2; + } btrfs_put_root(root); } else { /* Orphan reloc tree, just clean it up */