Btrfs: fix race when updating existing ref head

While we update an existing ref head's extent_op, we're not holding
its spinlock, so while we're updating its extent_op contents (key,
flags) we can have a task running __btrfs_run_delayed_refs() that
holds the ref head's lock and sets its extent_op to NULL right after
the task updating the ref head just checked its extent_op was not NULL.

Signed-off-by: Filipe David Borba Manana <fdmanana@gmail.com>
Signed-off-by: Chris Mason <clm@fb.com>

diff --git a/fs/btrfs/delayed-ref.c b/fs/btrfs/delayed-ref.c
index 2502ba5a3ac0b71155dc7db6501ba3124ecce979..31299646024d65340b4a8c401a41bdb594402d57 100644 (file)
--- a/fs/btrfs/delayed-ref.c
+++ b/fs/btrfs/delayed-ref.c
@@ -495,6 +495,7 @@ update_existing_head_ref(struct btrfs_delayed_ref_node *existing,
        ref = btrfs_delayed_node_to_head(update);
        BUG_ON(existing_ref->is_data != ref->is_data);
 
+       spin_lock(&existing_ref->lock);
        if (ref->must_insert_reserved) {
                /* if the extent was freed and then
                 * reallocated before the delayed ref
@@ -536,7 +537,6 @@ update_existing_head_ref(struct btrfs_delayed_ref_node *existing,
         * only need the lock for this case cause we could be processing it
         * currently, for refs we just added we know we're a-ok.
         */
-       spin_lock(&existing_ref->lock);
        existing->ref_mod += update->ref_mod;
        spin_unlock(&existing_ref->lock);
 }