Filipe Manana 292cbd51ec Btrfs: fix invalid block group rbtree access after bg is removed
If we grab a block group, for example in btrfs_trim_fs(), we will be holding
a reference on it but the block group can be removed after we got it (via
btrfs_remove_block_group), which means it will no longer be part of the
rbtree.

However, btrfs_remove_block_group() was only calling rb_erase() which leaves
the block group's rb_node left and right child pointers with the same content
they had before calling rb_erase. This was dangerous because a call to
next_block_group() would access the node's left and right child pointers (via
rb_next), which can be no longer valid.

Fix this by clearing a block group's node after removing it from the tree,
and have next_block_group() do a tree search to get the next block group
instead of using rb_next() if our block group was removed.

Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: Josef Bacik <jbacik@fb.com>
Signed-off-by: Chris Mason <clm@fb.com>
2014-12-02 18:19:17 -08:00
..
2014-10-09 02:39:04 -04:00
2014-08-08 15:57:24 -07:00
2014-10-14 08:40:15 +02:00
2014-11-13 22:19:05 +03:00
2014-10-17 17:17:12 -05:00
2014-08-08 15:57:20 -07:00
2014-10-09 02:38:57 -04:00
2014-08-07 14:40:09 -04:00
2014-10-16 12:53:35 +01:00
2014-11-05 08:49:38 -05:00
2014-10-09 13:06:14 +02:00
2014-11-07 08:33:52 +11:00
2014-09-24 13:31:50 -04:00
2014-08-07 14:40:09 -04:00
2014-10-24 00:14:38 +02:00
2014-10-24 00:14:38 +02:00
2014-10-24 00:14:35 +02:00
2014-08-26 09:35:56 +02:00
2014-08-27 11:17:48 +02:00