lkml.org 
[lkml]   [2012]   [Apr]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    SubjectRe: btrfs io errors on 3.4rc1
    On Tue, Apr 03, 2012 at 12:50:55PM -0400, Dave Jones wrote:
    > On Tue, Apr 03, 2012 at 06:33:43PM +0200, David Sterba wrote:
    > > On Tue, Apr 03, 2012 at 12:20:23PM -0400, Dave Jones wrote:
    > > > I see a lot of these ..
    > > >
    > > > btrfs: __btrfs_end_transaction -EIO abored=1802201963 (no super error)
    > >
    > > 1802201963 == 0x6b6b6b6b
    > >
    > > #define POISON_FREE 0x6b /* for use-after-free poisoning */
    > >
    > > hmm
    >
    > wait, what...
    >
    > 535 memset(trans, 0, sizeof(*trans));
    > 536 kmem_cache_free(btrfs_trans_handle_cachep, trans);
    > 537
    > 538 if (throttle)
    > 539 btrfs_run_delayed_iputs(root);
    > 540
    > 541 if (trans->aborted ||
    > 542 root->fs_info->fs_state & BTRFS_SUPER_FLAG_ERROR) {
    > 543 return -EIO;
    > 544 }
    >
    > that looks like a pretty clear use-after-free.

    Ok, trying this..


    diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
    index 8da29e8..11b77a5 100644
    --- a/fs/btrfs/transaction.c
    +++ b/fs/btrfs/transaction.c
    @@ -480,6 +480,7 @@ static int __btrfs_end_transaction(struct btrfs_trans_handle *trans,
    struct btrfs_transaction *cur_trans = trans->transaction;
    struct btrfs_fs_info *info = root->fs_info;
    int count = 0;
    + int err = 0;

    if (--trans->use_count) {
    trans->block_rsv = trans->orig_rsv;
    @@ -532,18 +533,18 @@ static int __btrfs_end_transaction(struct btrfs_trans_handle *trans,

    if (current->journal_info == trans)
    current->journal_info = NULL;
    - memset(trans, 0, sizeof(*trans));
    - kmem_cache_free(btrfs_trans_handle_cachep, trans);

    if (throttle)
    btrfs_run_delayed_iputs(root);

    if (trans->aborted ||
    root->fs_info->fs_state & BTRFS_SUPER_FLAG_ERROR) {
    - return -EIO;
    + err = -EIO;
    }

    - return 0;
    + memset(trans, 0, sizeof(*trans));
    + kmem_cache_free(btrfs_trans_handle_cachep, trans);
    + return err;
    }

    int btrfs_end_transaction(struct btrfs_trans_handle *trans,

    \
     
     \ /
      Last update: 2012-04-03 19:11    [W:0.027 / U:29.196 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site