Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'for-5.4-rc7-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux
Pull btrfs fix from David Sterba:
"A fix for an older bug that has started to show up during testing
(because of an updated test for rename exchange).
It's an in-memory corruption caused by local variable leaking out of
the function scope"
* tag 'for-5.4-rc7-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
Btrfs: fix log context list corruption after rename exchange operation
+15
+15
fs/btrfs/inode.c
+15
fs/btrfs/inode.c
···
9744
9744
commit_transaction = true;
9745
9745
}
9746
9746
if (commit_transaction) {
9747
+
/*
9748
+
* We may have set commit_transaction when logging the new name
9749
+
* in the destination root, in which case we left the source
9750
+
* root context in the list of log contextes. So make sure we
9751
+
* remove it to avoid invalid memory accesses, since the context
9752
+
* was allocated in our stack frame.
9753
+
*/
9754
+
if (sync_log_root) {
9755
+
mutex_lock(&root->log_mutex);
9756
+
list_del_init(&ctx_root.list);
9757
+
mutex_unlock(&root->log_mutex);
9758
+
}
9747
9759
ret = btrfs_commit_transaction(trans);
9748
9760
} else {
9749
9761
int ret2;
···
9768
9756
up_read(&fs_info->subvol_sem);
9769
9757
if (old_ino == BTRFS_FIRST_FREE_OBJECTID)
9770
9758
up_read(&fs_info->subvol_sem);
9759
+
9760
+
ASSERT(list_empty(&ctx_root.list));
9761
+
ASSERT(list_empty(&ctx_dest.list));
9771
9762
9772
9763
return ret;
9773
9764
}