• M
    Btrfs: fix wrong handle at error path of create_snapshot() when the commit fails · aec8030a
    Miao Xie 提交于
    There are several bugs at error path of create_snapshot() when the
    transaction commitment failed.
    - access the freed transaction handler. At the end of the
      transaction commitment, the transaction handler was freed, so we
      should not access it after the transaction commitment.
    - we were not aware of the error which happened during the snapshot
      creation if we submitted a async transaction commitment.
    - pending snapshot access vs pending snapshot free. when something
      wrong happened after we submitted a async transaction commitment,
      the transaction committer would cleanup the pending snapshots and
      free them. But the snapshot creators were not aware of it, they
      would access the freed pending snapshots.
    
    This patch fixes the above problems by:
    - remove the dangerous code that accessed the freed handler
    - assign ->error if the error happens during the snapshot creation
    - the transaction committer doesn't free the pending snapshots,
      just assigns the error number and evicts them before we unblock
      the transaction.
    Reported-by: NDan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: NMiao Xie <miaox@cn.fujitsu.com>
    Signed-off-by: NJosef Bacik <jbacik@fusionio.com>
    aec8030a
disk-io.c 107.4 KB