Btrfs devel - Dec 2013 - [PATCH 1/2] Btrfs: fix an oops when doing balance relocation

From: Wang Shilong <wangsl.fnst@cn.fujitsu.com>

I hit a BUG_ON() when inserting reloc root into rc->reloc_root_tree.rb_root,
the fact is block bytenr has been inserted before, this is really a redicious
bug, the reason is that we freed root node after we have allocated root
node block,and this block bytenr will be reused and then oops happens.

Signed-off-by: Wang Shilong <wangsl.fnst@cn.fujitsu.com>
---
 fs/btrfs/relocation.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
index ce459a7..4dc7f26 100644
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -1361,7 +1361,6 @@ static struct btrfs_root *create_reloc_root(struct
btrfs_trans_handle *trans,
 	}
 
 	btrfs_tree_unlock(eb);
-	free_extent_buffer(eb);
 
 	ret = btrfs_insert_root(trans, root->fs_info->tree_root,
 				&root_key, root_item);
-- 
1.8.4

--
To unsubscribe from this list: send the line "unsubscribe linux-btrfs"
in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

From: Wang Shilong <wangsl.fnst@cn.fujitsu.com>

Quota tree and UUID Tree is only cowed, they can not be snapshoted.

Signed-off-by: Wang Shilong <wangsl.fnst@cn.fujitsu.com>
---
 fs/btrfs/relocation.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
index 4dc7f26..df6e18e 100644
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -571,7 +571,9 @@ static int is_cowonly_root(u64 root_objectid)
 	    root_objectid == BTRFS_CHUNK_TREE_OBJECTID ||
 	    root_objectid == BTRFS_DEV_TREE_OBJECTID ||
 	    root_objectid == BTRFS_TREE_LOG_OBJECTID ||
-	    root_objectid == BTRFS_CSUM_TREE_OBJECTID)
+	    root_objectid == BTRFS_CSUM_TREE_OBJECTID ||
+	    root_objectid == BTRFS_UUID_TREE_OBJECTID ||
+	    root_objectid == BTRFS_QUOTA_TREE_OBJECTID)
 		return 1;
 	return 0;
 }
-- 
1.8.4

--
To unsubscribe from this list: send the line "unsubscribe linux-btrfs"
in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

On 12/10/2013 12:14 AM, Wang Shilong wrote:
> From: Wang Shilong <wangsl.fnst@cn.fujitsu.com>
>
> I hit a BUG_ON() when inserting reloc root into
rc->reloc_root_tree.rb_root,
> the fact is block bytenr has been inserted before, this is really a
redicious
> bug, the reason is that we freed root node after we have allocated root
> node block,and this block bytenr will be reused and then oops happens.
oops, this is wrong, sorry for noise.

Thanks,
Wang
>
> Signed-off-by: Wang Shilong <wangsl.fnst@cn.fujitsu.com>
> ---
>   fs/btrfs/relocation.c | 1 -
>   1 file changed, 1 deletion(-)
>
> diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
> index ce459a7..4dc7f26 100644
> --- a/fs/btrfs/relocation.c
> +++ b/fs/btrfs/relocation.c
> @@ -1361,7 +1361,6 @@ static struct btrfs_root *create_reloc_root(struct
btrfs_trans_handle *trans,
>   	}
>   
>   	btrfs_tree_unlock(eb);
> -	free_extent_buffer(eb);
>   
>   	ret = btrfs_insert_root(trans, root->fs_info->tree_root,
>   				&root_key, root_item);
--
To unsubscribe from this list: send the line "unsubscribe linux-btrfs"
in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

2013/12/10 Wang Shilong
<wangsl.fnst@cn.fujitsu.com>:
> On 12/10/2013 12:14 AM, Wang Shilong wrote:
>>
>> From: Wang Shilong <wangsl.fnst@cn.fujitsu.com>
>>
>> I hit a BUG_ON() when inserting reloc root into
>> rc->reloc_root_tree.rb_root,
>> the fact is block bytenr has been inserted before, this is really a
>> redicious
>> bug, the reason is that we freed root node after we have allocated root
>> node block,and this block bytenr will be reused and then oops happens.
>
By hacking the code (force cow for relocation tree),  BUG_ON() can be triggered
easily.

The problem is that reloc root bytenr inserted into @reloc_root_tree
is not within
one transaction. root block node can be cowed while it is still in
@reloc_root_tree
and  previous relocation root block can be reused and this oops happen.

We can fix it by updating relocation root node in @reloc_root_tree
when cowing block,
Patch has been make and hopely it can fix this problem, will send v2 later. ^_^
> oops, this is wrong, sorry for noise.
Previously, i really made mistakes, free_extent_buffer() even won''t
free tree block,
it just dec refs and free memory if possible.

Thanks,
Wang
>
>>
>> Signed-off-by: Wang Shilong <wangsl.fnst@cn.fujitsu.com>
>> ---
>>   fs/btrfs/relocation.c | 1 -
>>   1 file changed, 1 deletion(-)
>>
>> diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
>> index ce459a7..4dc7f26 100644
>> --- a/fs/btrfs/relocation.c
>> +++ b/fs/btrfs/relocation.c
>> @@ -1361,7 +1361,6 @@ static struct btrfs_root
*create_reloc_root(struct
>> btrfs_trans_handle *trans,
>>         }
>>         btrfs_tree_unlock(eb);
>> -       free_extent_buffer(eb);
>>         ret = btrfs_insert_root(trans, root->fs_info->tree_root,
>>                                 &root_key, root_item);
>
>
--
To unsubscribe from this list: send the line "unsubscribe linux-btrfs"
in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html