From 4d47b21c4dac0d27ad02add2c68be0afaa63ef98 Mon Sep 17 00:00:00 2001 From: Kent Overstreet Date: Mon, 19 Apr 2021 17:17:34 -0400 Subject: [PATCH] bcachefs: Fix a use after free Turns out, we weren't waiting on in flight btree writes when freeing existing btree nodes. This lead to stray btree writes overwriting newly allocated buckets, but only started showing itself with some of the recent allocator work and another patch to move submitting of btree writes to worqueues. Signed-off-by: Kent Overstreet Signed-off-by: Kent Overstreet --- fs/bcachefs/btree_update_interior.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/fs/bcachefs/btree_update_interior.c b/fs/bcachefs/btree_update_interior.c index b3137525f9c14..dabd1a3e3aa3a 100644 --- a/fs/bcachefs/btree_update_interior.c +++ b/fs/bcachefs/btree_update_interior.c @@ -887,6 +887,14 @@ void bch2_btree_interior_update_will_free_node(struct btree_update *as, btree_update_drop_new_node(c, b); btree_update_will_delete_key(as, &b->key); + + /* + * XXX: Waiting on io with btree node locks held, we don't want to be + * doing this. We can't have btree writes happening after the space has + * been freed, but we really only need to block before + * btree_update_nodes_written_trans() happens. + */ + btree_node_wait_on_io(b); } void bch2_btree_update_done(struct btree_update *as) -- 2.30.2