From: Kent Overstreet Date: Mon, 19 Apr 2021 21:17:34 +0000 (-0400) Subject: bcachefs: Fix a use after free X-Git-Url: http://git.maquefel.me/?a=commitdiff_plain;h=4d47b21c4dac0d27ad02add2c68be0afaa63ef98;p=linux.git bcachefs: Fix a use after free Turns out, we weren't waiting on in flight btree writes when freeing existing btree nodes. This lead to stray btree writes overwriting newly allocated buckets, but only started showing itself with some of the recent allocator work and another patch to move submitting of btree writes to worqueues. Signed-off-by: Kent Overstreet Signed-off-by: Kent Overstreet --- diff --git a/fs/bcachefs/btree_update_interior.c b/fs/bcachefs/btree_update_interior.c index b3137525f9c14..dabd1a3e3aa3a 100644 --- a/fs/bcachefs/btree_update_interior.c +++ b/fs/bcachefs/btree_update_interior.c @@ -887,6 +887,14 @@ void bch2_btree_interior_update_will_free_node(struct btree_update *as, btree_update_drop_new_node(c, b); btree_update_will_delete_key(as, &b->key); + + /* + * XXX: Waiting on io with btree node locks held, we don't want to be + * doing this. We can't have btree writes happening after the space has + * been freed, but we really only need to block before + * btree_update_nodes_written_trans() happens. + */ + btree_node_wait_on_io(b); } void bch2_btree_update_done(struct btree_update *as)