FAILED: patch "[PATCH] btrfs: fix extent map leak in NOCOW direct I/O write" failed to apply to 6.1-stable tree
Subsystems (2)
[email protected]
maintainerThe patch below does not apply to the 6.1-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y
git checkout FETCH_HEAD
git cherry-pick -x 3f950867c307c5413d628a153ac44915bd117ffd
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2026090310-catchy-recollect-7ab5@gregkh' --subject-prefix 'PATCH 6.1.y' 'HEAD^..'
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 3f950867c307c5413d628a153ac44915bd117ffd Mon Sep 17 00:00:00 2001
From: Shuangpeng Bai <[email protected]>
Date: Sun, 5 Jul 2026 01:46:35 -0400
Subject: [PATCH] btrfs: fix extent map leak in NOCOW direct I/O write
btrfs_dio_iomap_begin() calls btrfs_get_extent(), which returns an extent map reference that must be dropped on all exit paths.
For direct writes into a NOCOW range, btrfs_get_blocks_direct_write() keeps using that extent map and asks btrfs_create_dio_extent() to allocate the ordered extent. If that fails, for example because btrfs_alloc_ordered_extent() fails, the function returns the error without dropping the input extent map. The PREALLOC path avoided this by dropping the input extent map before replacing it with the newly created one.
Check the error from btrfs_create_dio_extent() before replacing the map and drop the input extent map on failure.
fs/btrfs/direct-io.c +13 -6
@@ -280,17 +280,24 @@ static int btrfs_get_blocks_direct_write(struct extent_map **map, em2 =btrfs_create_dio_extent (BTRFS_I (inode), dio_data, start, &file_extent, type);btrfs_dec_nocow_writers (bg); -if (type ==BTRFS_ORDERED_PREALLOC ) { +if (IS_ERR (em2)) { + ret =PTR_ERR (em2); +btrfs_free_extent_map (em); + *map =NULL ; + goto out; + } + +/* +* True NOCOW writes don't need to create a new extent map, +* while PREALLOC writes must replace the existing one. +*/ +if (em2) { +ASSERT (type ==BTRFS_ORDERED_PREALLOC );btrfs_free_extent_map (em); *map = em2; em = em2; } -if (IS_ERR (em2)) { - ret =PTR_ERR (em2); - goto out; - } - dio_data->nocow_done = true; }else {/* Our caller expects us to free the input extent map. */
Sasha Levin
maintainerPATCH 1/3 btrfs: prepare btrfs_punch_hole_lock_range() for large data folios
From: Qu Wenruo <[email protected]>
[ Upstream commit 1e5773e0bab761c853eaf7286394905a544ef02d ]
The function btrfs_punch_hole_lock_range() needs to make sure there is no other folio in the range, thus it goes with filemap_range_has_page(), which works pretty fine.
But if we have large folios, under the following case filemap_range_has_page() will always return true, forcing btrfs_punch_hole_lock_range() to do a very time consuming busy loop:
start end
| |
|//|//|//|//| | | | | | | | |//|//| \ / \ /
Folio A Folio B
In the above case, folio A and B contain our start/end indexes, and there are no other folios in the range. Thus we do not need to retry inside btrfs_punch_hole_lock_range().
To prepare for large data folios, introduce a helper, check_range_has_page(), which will:
- Shrink the search range towards page boundaries
If the rounded down end (exclusive, otherwise it can underflow when @end is inside the folio at file offset 0) is no larger than the rounded up start, it means the range contains no other pages other than the ones covering @start and @end.
Can return false directly in that case.
- Grab all the folios inside the range
- Skip any large folios that cover the start and end indexes
- If any other folios are found return true
- Otherwise return false
This new helper is going to handle both large folios and regular ones.
Stable-dep-of: 3f950867c307 ("btrfs: fix extent map leak in NOCOW direct I/O write")
--- fs/btrfs/file.c | 67 +++++++++++++++++++++++++++++++++++++++++-------- 1 file changed, 56 insertions(+), 11 deletions(-)
fs/btrfs/file.c +56 -11
@@ -2204,11 +2204,29 @@ static int find_first_non_hole(struct btrfs_inode *inode, u64 *start, u64 *len)return ret; } -static void btrfs_punch_hole_lock_range (struct inode *inode, -const u64 lockstart, -const u64 lockend, -struct extent_state **cached_state) +/* +* Check if there is no folio in the range. +* +* We cannot utilize filemap_range_has_page() in a filemap with large folios +* as we can hit the following false positive: +* +* start end +* | | +* |//|//|//|//| | | | | | | | |//|//| +* \ / \ / +* Folio A Folio B +* +* That large folio A and B cover the start and end indexes. +* In that case filemap_range_has_page() will always return true, but the above +* case is fine for btrfs_punch_hole_lock_range() usage. +* +* So here we only ensure that no other folios is in the range, excluding the +* head/tail large folio. +*/ +static bool check_range_has_page (struct inode *inode,u64 start,u64 end) { +struct folio_batch fbatch; +bool ret = false;/* * For subpage case, if the range is not at page boundary, we could * have pages at the leading/tailing part of the range.
@@ -2219,17 +2237,45 @@ static void btrfs_punch_hole_lock_range(struct inode *inode,* * And do not decrease page_lockend right now, as it can be 0. */ -const u64 page_lockstart =round_up (lockstart,PAGE_SIZE ); -const u64 page_lockend =round_down (lockend +1 ,PAGE_SIZE ); +const u64 page_lockstart =round_up (start,PAGE_SIZE ); +const u64 page_lockend =round_down (end +1 ,PAGE_SIZE ); +const pgoff_t start_index = page_lockstart >>PAGE_SHIFT ; +const pgoff_t end_index = (page_lockend -1 ) >>PAGE_SHIFT ; +pgoff_t tmp = start_index; +int found_folios; + +/* The same page or adjacent pages. */ +if (page_lockend <= page_lockstart) +return false; + +folio_batch_init (&fbatch); + found_folios =filemap_get_folios (inode->i_mapping, &tmp, end_index, &fbatch); +for (int i =0 ; i < found_folios; i++) { +struct folio *folio = fbatch.folios[i]; +/* A large folio begins before the start. Not a target. */ +if (folio->index < start_index) +continue ; +/* A large folio extends beyond the end. Not a target. */ +if (folio->index +folio_nr_pages (folio) > end_index) +continue ; +/* A folio doesn't cover the head/tail index. Found a target. */ + ret = true; +break ; + } +folio_batch_release (&fbatch); +return ret; +} + +static void btrfs_punch_hole_lock_range (struct inode *inode, +const u64 lockstart,const u64 lockend, +struct extent_state **cached_state) +{while (1 ) {truncate_pagecache_range (inode, lockstart, lockend);lock_extent (&BTRFS_I (inode)->io_tree, lockstart, lockend, cached_state); -/* The same page or adjacent pages. */ -if (page_lockend <= page_lockstart) -break ;/* * We can't have ordered extents in the range, nor dirty/writeback * pages, because we have locked the inode's VFS lock in exclusive
@@ -2240,8 +2286,7 @@ static void btrfs_punch_hole_lock_range(struct inode *inode,* locking the range check if we have pages in the range, and if * we do, unlock the range and retry. */ -if (!filemap_range_has_page (inode->i_mapping, page_lockstart, - page_lockend -1 )) +if (!check_range_has_page (inode, lockstart, lockend))break ; unlock_extent(&BTRFS_I(inode)->io_tree, lockstart, lockend,
Signature · 1 line
2.53.0
Sasha Levin
maintainerPATCH 2/3 btrfs: rename functions to allocate and free extent maps
From: Filipe Manana <[email protected]>
[ Upstream commit ae98ae2a50d72b01d0a61cb21e1ac75bfcebc5f3 ]
These functions are exported and don't have a 'btrfs_' prefix in their names, which goes against coding style conventions. Rename them to have such prefix, making it clear they are from btrfs and avoiding potential collisions in the future with functions defined elsewhere outside btrfs.
[ sashal: Reduced backport -- upstream ae98ae2a50d72 touches 13 file(s), this
backport carries 16. Not backported here:
fs/btrfs/defrag.c
fs/btrfs/direct-io.c
This note is generated from the file lists only; see the resolution record for the reasoning. ]
Stable-dep-of: 3f950867c307 ("btrfs: fix extent map leak in NOCOW direct I/O write")
--- fs/btrfs/block-group.c | 20 +++---- fs/btrfs/compression.c | 10 ++-- fs/btrfs/dev-replace.c | 4 +- fs/btrfs/extent_io.c | 16 +++--- fs/btrfs/extent_map.c | 36 ++++++------- fs/btrfs/extent_map.h | 4 +- fs/btrfs/file.c | 37 ++++++------- fs/btrfs/inode.c | 88 +++++++++++++++---------------- fs/btrfs/ioctl.c | 14 ++--- fs/btrfs/relocation.c | 4 +- fs/btrfs/scrub.c | 2 +- fs/btrfs/tests/extent-map-tests.c | 52 +++++++++--------- fs/btrfs/tests/inode-tests.c | 42 +++++++-------- fs/btrfs/tree-log.c | 4 +- fs/btrfs/volumes.c | 52 +++++++++--------- fs/btrfs/zoned.c | 6 +-- 16 files changed, 196 insertions(+), 195 deletions(-)
fs/btrfs/block-group.c +10 -10
@@ -1152,7 +1152,7 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans,remove_extent_mapping (em_tree, em);write_unlock (&em_tree->lock);/* once for the tree */ -free_extent_map (em); +btrfs_free_extent_map (em); } out:
@@ -1199,7 +1199,7 @@ struct btrfs_trans_handle *btrfs_start_trans_remove_block_group(*/ map = em->map_lookup; num_items =3 + map->num_stripes; -free_extent_map (em); +btrfs_free_extent_map (em);return btrfs_start_transaction_fallback_global_rsv (root, num_items); }
@@ -1854,7 +1854,7 @@ static int read_bg_from_eb(struct btrfs_fs_info *fs_info, struct btrfs_key *key, } out_free_em: -free_extent_map (em); +btrfs_free_extent_map (em);return ret; }
@@ -1982,7 +1982,7 @@ int btrfs_rmap_block(struct btrfs_fs_info *fs_info, u64 chunk_start, *naddrs = nr; *stripe_len = io_stripe_size; out: -free_extent_map (em); +btrfs_free_extent_map (em);return ret; }
@@ -2111,7 +2111,7 @@ static int check_chunk_block_group_mappings(struct btrfs_fs_info *fs_info)"chunk start=%llu len=%llu doesn't have corresponding block group" , em->start, em->len); ret = -EUCLEAN ; -free_extent_map (em); +btrfs_free_extent_map (em);break ; } if (bg->start != em->start || bg->length != em->len ||
@@ -2124,12 +2124,12 @@ static int check_chunk_block_group_mappings(struct btrfs_fs_info *fs_info) bg->start, bg->length, bg->flags & BTRFS_BLOCK_GROUP_TYPE_MASK); ret = -EUCLEAN ; -free_extent_map (em); +btrfs_free_extent_map (em);btrfs_put_block_group (bg);break ; } start = em->start + em->len; -free_extent_map (em); +btrfs_free_extent_map (em);btrfs_put_block_group (bg); }return ret;
@@ -2529,7 +2529,7 @@ static int insert_dev_extents(struct btrfs_trans_handle *trans, }mutex_unlock (&fs_info->fs_devices->device_list_mutex); -free_extent_map (em); +btrfs_free_extent_map (em);return ret; }
@@ -4306,8 +4306,8 @@ void btrfs_unfreeze_block_group(struct btrfs_block_group *block_group)write_unlock (&em_tree->lock);/* once for us and once for the tree */ -free_extent_map (em); -free_extent_map (em); +btrfs_free_extent_map (em); +btrfs_free_extent_map (em);/* * We may have left one free space entry and other possible
fs/btrfs/compression.c +5 -5
@@ -354,7 +354,7 @@ static struct bio *alloc_compressed_bio(struct compressed_bio *cb, u64 disk_bytebio_set_dev (bio, em->map_lookup->stripes[0 ].dev->bdev); ret =btrfs_get_io_geometry (fs_info, em,btrfs_op (bio), disk_bytenr, &geom); -free_extent_map (em); +btrfs_free_extent_map (em);if (ret <0 ) {bio_put (bio);return ERR_PTR (ret);
@@ -607,14 +607,14 @@ static noinline int add_ra_bio_pages(struct inode *inode,if (!em || cur < em->start || (cur + fs_info->sectorsize >extent_map_end (em)) || (em->block_start >>9 ) != cb->orig_bio->bi_iter.bi_sector) { -free_extent_map (em); +btrfs_free_extent_map (em);unlock_extent (tree, cur, page_end,NULL );unlock_page (page);put_page (page);break ; } add_size =min (em->start + em->len, page_end +1 ) - cur; -free_extent_map (em); +btrfs_free_extent_map (em);if (page->index == end_index) {size_t zero_offset =offset_in_page (isize);
@@ -713,7 +713,7 @@ void btrfs_submit_compressed_read(struct inode *inode, struct bio *bio, cb->compress_type = em->compress_type; cb->orig_bio = bio; -free_extent_map (em); +btrfs_free_extent_map (em); em =NULL ; cb->nr_pages =DIV_ROUND_UP (compressed_len,PAGE_SIZE );
@@ -827,7 +827,7 @@ void btrfs_submit_compressed_read(struct inode *inode, struct bio *bio,kfree (cb->compressed_pages);kfree (cb); out: -free_extent_map (em); +btrfs_free_extent_map (em);btrfs_bio_end_io (btrfs_bio (bio), ret);return ; }
fs/btrfs/dev-replace.c +2 -2
@@ -596,7 +596,7 @@ bool btrfs_finish_block_group_to_copy(struct btrfs_device *srcdev, cur_extent = i; } -free_extent_map (em); +btrfs_free_extent_map (em);if (num_extents >1 && cur_extent < num_extents -1 ) {/*
@@ -857,7 +857,7 @@ static void btrfs_dev_replace_update_device_in_mapping_tree(if (srcdev == map->stripes[i].dev) map->stripes[i].dev = tgtdev; start = em->start + em->len; -free_extent_map (em); +btrfs_free_extent_map (em); }while (start);write_unlock (&em_tree->lock); }
fs/btrfs/extent_io.c +8 -8
@@ -1458,7 +1458,7 @@ static int calc_bio_boundaries(struct btrfs_bio_ctrl *bio_ctrl,return PTR_ERR (em); ret =btrfs_get_io_geometry (fs_info, em,btrfs_op (bio_ctrl->bio), logical, &geom); -free_extent_map (em); +btrfs_free_extent_map (em);if (ret <0 ) {return ret; }
@@ -1721,7 +1721,7 @@ __get_extent_map(struct inode *inode, struct page *page, size_t pg_offset,return em; } -free_extent_map (em); +btrfs_free_extent_map (em); *em_cached =NULL ; }
@@ -1861,7 +1861,7 @@ static int btrfs_do_readpage(struct page *page, struct extent_map **em_cached,if (prev_em_start) *prev_em_start = em->start; -free_extent_map (em); +btrfs_free_extent_map (em); em =NULL ;/* we've found a hole, just zero and go on */
@@ -2168,7 +2168,7 @@ static noinline_for_stack int __extent_writepage_io(struct btrfs_inode *inode,if (btrfs_use_zone_append (inode, em->block_start)) op =REQ_OP_ZONE_APPEND ; -free_extent_map (em); +btrfs_free_extent_map (em); em =NULL ;/*
@@ -3340,7 +3340,7 @@ void extent_readahead(struct readahead_control *rac) }if (em_cached) -free_extent_map (em_cached); +btrfs_free_extent_map (em_cached);submit_one_bio (&bio_ctrl); }
@@ -3446,7 +3446,7 @@ int try_release_extent_mapping(struct page *page, gfp_t mask)if (test_bit (EXTENT_FLAG_PINNED , &em->flags) || em->start != start) {write_unlock (&map->lock); -free_extent_map (em); +btrfs_free_extent_map (em);break ; } if (test_range_bit(tree, em->start,
@@ -3486,13 +3486,13 @@ int try_release_extent_mapping(struct page *page, gfp_t mask)*/ remove_extent_mapping (map, em);/* once for the rb tree */ -free_extent_map (em); +btrfs_free_extent_map (em); next: start =extent_map_end (em);write_unlock (&map->lock);/* once for us */ -free_extent_map (em); +btrfs_free_extent_map (em);cond_resched ();/* Allow large-extent preemption. */ }
fs/btrfs/extent_map.c +18 -18
@@ -46,9 +46,9 @@ void extent_map_tree_init(struct extent_map_tree *tree)* * Allocate a new extent_map structure. The new structure is * returned with a reference count of one and needs to be -* freed using free_extent_map() +* freed using btrfs_free_extent_map() */ -struct extent_map *alloc_extent_map (void ) +struct extent_map *btrfs_alloc_extent_map (void ) {struct extent_map *em; em =kmem_cache_zalloc (extent_map_cache,GFP_NOFS );
@@ -68,7 +68,7 @@ struct extent_map *alloc_extent_map(void)* Drops the reference out on @em by one and free the structure * if the reference count hits zero. */ -void free_extent_map (struct extent_map *em) +void btrfs_free_extent_map (struct extent_map *em) {if (!em)return ;
@@ -269,7 +269,7 @@ static void try_merge_map(struct extent_map_tree *tree, struct extent_map *em)rb_erase_cached (&merge->rb_node, &tree->map);RB_CLEAR_NODE (&merge->rb_node); -free_extent_map (merge); +btrfs_free_extent_map (merge); } }
@@ -284,7 +284,7 @@ static void try_merge_map(struct extent_map_tree *tree, struct extent_map *em) em->mod_len = (merge->mod_start + merge->mod_len) - em->mod_start; em->generation =max (em->generation, merge->generation);set_bit (EXTENT_FLAG_MERGED , &em->flags); -free_extent_map (merge); +btrfs_free_extent_map (merge); } }
@@ -331,7 +331,7 @@ int unpin_extent_cache(struct extent_map_tree *tree, u64 start, u64 len, em->mod_len = em->len; } -free_extent_map (em); +btrfs_free_extent_map (em); out:write_unlock (&tree->lock);return ret;
@@ -662,7 +662,7 @@ int btrfs_add_extent_mapping(struct btrfs_fs_info *fs_info,*/ if (start >= existing->start && start <extent_map_end (existing)) { -free_extent_map (em); +btrfs_free_extent_map (em); *em_in = existing; ret =0 ; }else {
@@ -676,14 +676,14 @@ int btrfs_add_extent_mapping(struct btrfs_fs_info *fs_info, ret =merge_extent_mapping (em_tree, existing, em, start);if (ret) { -free_extent_map (em); +btrfs_free_extent_map (em); *em_in =NULL ;WARN_ONCE (ret,"unexpected error %d: merge existing(start %llu len %llu) with em(start %llu len %llu)\n" , ret, existing->start, existing->len, orig_start, orig_len); } -free_extent_map (existing); +btrfs_free_extent_map (existing); } }
@@ -708,7 +708,7 @@ static void drop_all_extent_maps_fast(struct extent_map_tree *tree)clear_bit (EXTENT_FLAG_PINNED , &em->flags);clear_bit (EXTENT_FLAG_LOGGING , &em->flags);remove_extent_mapping (tree, em); -free_extent_map (em); +btrfs_free_extent_map (em);cond_resched_rwlock_write (&tree->lock); }write_unlock (&tree->lock);
@@ -757,8 +757,8 @@ void btrfs_drop_extent_map_range(struct btrfs_inode *inode, u64 start, u64 end,* range ends after our range (and they might be the same extent map), * because we need to split those two extent maps at the boundaries. */ - split =alloc_extent_map (); - split2 =alloc_extent_map (); + split =btrfs_alloc_extent_map (); + split2 =btrfs_alloc_extent_map ();write_lock (&em_tree->lock); em =lookup_extent_mapping (em_tree, start, len);
@@ -840,7 +840,7 @@ void btrfs_drop_extent_map_range(struct btrfs_inode *inode, u64 start, u64 end, split->flags = flags; split->compress_type = em->compress_type;replace_extent_mapping (em_tree, em, split, modified); -free_extent_map (split); +btrfs_free_extent_map (split); split = split2; split2 =NULL ; }
@@ -893,7 +893,7 @@ void btrfs_drop_extent_map_range(struct btrfs_inode *inode, u64 start, u64 end,if (WARN_ON (ret !=0 ) && modified)btrfs_set_inode_full_sync (inode); } -free_extent_map (split); +btrfs_free_extent_map (split); split =NULL ; } remove_em:
@@ -929,18 +929,18 @@ void btrfs_drop_extent_map_range(struct btrfs_inode *inode, u64 start, u64 end,* Once for the tree reference (we replaced or removed the * extent map from the tree). */ -free_extent_map (em); +btrfs_free_extent_map (em); next:/* Once for us (for our lookup reference). */ -free_extent_map (em); +btrfs_free_extent_map (em); em = next_em; }write_unlock (&em_tree->lock); -free_extent_map (split); -free_extent_map (split2); +btrfs_free_extent_map (split); +btrfs_free_extent_map (split2); }/*
fs/btrfs/extent_map.h +2 -2
@@ -97,8 +97,8 @@ void replace_extent_mapping(struct extent_map_tree *tree,struct extent_map *new, int modified); -struct extent_map *alloc_extent_map (void ); -void free_extent_map (struct extent_map *em); +struct extent_map *btrfs_alloc_extent_map (void ); +void btrfs_free_extent_map (struct extent_map *em);int __init extent_map_init (void );void __cold extent_map_exit (void );int unpin_extent_cache (struct extent_map_tree *tree,u64 start,u64 len,u64 gen);
fs/btrfs/file.c +19 -18
@@ -5,6 +5,7 @@#include <linux/fs.h> #include <linux/pagemap.h> +#include <linux/pagevec.h> #include <linux/time.h> #include <linux/init.h> #include <linux/string.h>
@@ -2150,7 +2151,7 @@ static int fill_holes(struct btrfs_trans_handle *trans, out:btrfs_release_path (path); - hole_em =alloc_extent_map (); + hole_em =btrfs_alloc_extent_map ();if (!hole_em) {btrfs_drop_extent_map_range (inode, offset, end -1 , false);btrfs_set_inode_full_sync (inode);
@@ -2167,7 +2168,7 @@ static int fill_holes(struct btrfs_trans_handle *trans, hole_em->generation = trans->transid; ret =btrfs_replace_extent_map_range (inode, hole_em, true); -free_extent_map (hole_em); +btrfs_free_extent_map (hole_em);if (ret)btrfs_set_inode_full_sync (inode); }
@@ -2200,7 +2201,7 @@ static int find_first_non_hole(struct btrfs_inode *inode, u64 *start, u64 *len) 0 : *start + *len - em->start - em->len; *start = em->start + em->len; } -free_extent_map (em); +btrfs_free_extent_map (em);return ret; }
@@ -2919,7 +2920,7 @@ static int btrfs_zero_range_check_range_boundary(struct btrfs_inode *inode,else ret =RANGE_BOUNDARY_WRITTEN_EXTENT ; -free_extent_map (em); +btrfs_free_extent_map (em);return ret; }
@@ -2964,7 +2965,7 @@ static int btrfs_zero_range(struct inode *inode,* do nothing except updating the inode's i_size if * needed. */ -free_extent_map (em); +btrfs_free_extent_map (em); ret =btrfs_fallocate_update_isize (inode, offset + len, mode); goto out;
@@ -2979,7 +2980,7 @@ static int btrfs_zero_range(struct inode *inode, offset = alloc_start; alloc_hint = em->block_start + em->len; } -free_extent_map (em); +btrfs_free_extent_map (em);if (BTRFS_BYTES_TO_BLKS (fs_info, offset) ==BTRFS_BYTES_TO_BLKS (fs_info, offset + len -1 )) {
@@ -2991,13 +2992,13 @@ static int btrfs_zero_range(struct inode *inode, }if (test_bit (EXTENT_FLAG_PREALLOC , &em->flags)) { -free_extent_map (em); +btrfs_free_extent_map (em); ret =btrfs_fallocate_update_isize (inode, offset + len, mode); goto out; }if (len < sectorsize && em->block_start !=EXTENT_MAP_HOLE ) { -free_extent_map (em); +btrfs_free_extent_map (em); ret =btrfs_truncate_block (BTRFS_I (inode), offset, len,0 );if (!ret)
@@ -3006,7 +3007,7 @@ static int btrfs_zero_range(struct inode *inode, mode);return ret; } -free_extent_map (em); +btrfs_free_extent_map (em); alloc_start =round_down (offset, sectorsize); alloc_end = alloc_start + sectorsize; goto reserve_space;
@@ -3217,19 +3218,19 @@ static long btrfs_fallocate(struct file *file, int mode, ret =add_falloc_range (&reserve_list, cur_offset, range_len);if (ret <0 ) { -free_extent_map (em); +btrfs_free_extent_map (em);break ; } ret =btrfs_qgroup_reserve_data (BTRFS_I (inode), &data_reserved, cur_offset, range_len);if (ret <0 ) { -free_extent_map (em); +btrfs_free_extent_map (em);break ; } qgroup_reserved += range_len; data_space_needed += range_len; } -free_extent_map (em); +btrfs_free_extent_map (em); cur_offset = last_byte; }
@@ -3354,7 +3355,7 @@ static bool find_delalloc_subrange(struct btrfs_inode *inode, u64 start, u64 endstruct extent_map *next_em; next_em =btrfs_next_extent_map (em_tree, em); -free_extent_map (em); +btrfs_free_extent_map (em);/* * There's no next extent map or the next one starts beyond our
@@ -3362,7 +3363,7 @@ static bool find_delalloc_subrange(struct btrfs_inode *inode, u64 start, u64 end*/ if (!next_em || next_em->start > end) {read_unlock (&em_tree->lock); -free_extent_map (next_em); +btrfs_free_extent_map (next_em);return (delalloc_len >0 ); }
@@ -3378,7 +3379,7 @@ static bool find_delalloc_subrange(struct btrfs_inode *inode, u64 start, u64 end*/ if (em->block_start ==EXTENT_MAP_HOLE ||test_bit (EXTENT_FLAG_PREALLOC , &em->flags)) { -free_extent_map (em); +btrfs_free_extent_map (em);return (delalloc_len >0 ); }
@@ -3389,7 +3390,7 @@ static bool find_delalloc_subrange(struct btrfs_inode *inode, u64 start, u64 endif (delalloc_len ==0 ) { *delalloc_start_ret = em->start; *delalloc_end_ret =min (end, em_end -1 ); -free_extent_map (em); +btrfs_free_extent_map (em);return true; }
@@ -3406,7 +3407,7 @@ static bool find_delalloc_subrange(struct btrfs_inode *inode, u64 start, u64 endif (em_end < *delalloc_start_ret) *delalloc_end_ret =min (end, em_end -1 ); -free_extent_map (em); +btrfs_free_extent_map (em);return true; }
@@ -3418,7 +3419,7 @@ static bool find_delalloc_subrange(struct btrfs_inode *inode, u64 start, u64 endif (*delalloc_end_ret +1 == em->start) *delalloc_end_ret =min (end, em_end -1 ); -free_extent_map (em); +btrfs_free_extent_map (em);return true; }
fs/btrfs/inode.c +44 -44
307 lines not on this page · raw message
fs/btrfs/ioctl.c +7 -7
@@ -1097,7 +1097,7 @@ static struct extent_map *defrag_get_extent(struct btrfs_inode *inode,u64 ino =btrfs_ino (inode);int ret; - em =alloc_extent_map (); + em =btrfs_alloc_extent_map ();if (!em) { ret = -ENOMEM ; goto err;
@@ -1205,12 +1205,12 @@ static struct extent_map *defrag_get_extent(struct btrfs_inode *inode, not_found:btrfs_release_path (&path); -free_extent_map (em); +btrfs_free_extent_map (em);return NULL ; err:btrfs_release_path (&path); -free_extent_map (em); +btrfs_free_extent_map (em);return ERR_PTR (ret); }
@@ -1240,7 +1240,7 @@ static struct extent_map *defrag_lookup_extent(struct inode *inode, u64 start,*/ if (em &&test_bit (EXTENT_FLAG_MERGED , &em->flags) && newer_than && em->generation >= newer_than) { -free_extent_map (em); +btrfs_free_extent_map (em); em =NULL ; }
@@ -1308,7 +1308,7 @@ static bool defrag_check_next_extent(struct inode *inode, struct extent_map *em, ret = true; out: -free_extent_map (next); +btrfs_free_extent_map (next);return ret; }
@@ -1572,7 +1572,7 @@ static int defrag_collect_targets(struct btrfs_inode *inode,/* Allocate new defrag_target_range */ new =kmalloc (sizeof (*new),GFP_NOFS );if (!new) { -free_extent_map (em); +btrfs_free_extent_map (em); ret = -ENOMEM ;break ; }
@@ -1582,7 +1582,7 @@ static int defrag_collect_targets(struct btrfs_inode *inode, next: cur =extent_map_end (em); -free_extent_map (em); +btrfs_free_extent_map (em); }if (ret <0 ) {struct defrag_target_range *entry;
fs/btrfs/relocation.c +2 -2
@@ -2957,7 +2957,7 @@ static noinline_for_stack int setup_relocation_extent_mapping(struct inode *inodstruct extent_map *em;int ret =0 ; - em =alloc_extent_map (); + em =btrfs_alloc_extent_map ();if (!em)return -ENOMEM ;
@@ -2970,7 +2970,7 @@ static noinline_for_stack int setup_relocation_extent_mapping(struct inode *inodlock_extent (&BTRFS_I (inode)->io_tree, start, end,NULL ); ret =btrfs_replace_extent_map_range (BTRFS_I (inode), em, false);unlock_extent (&BTRFS_I (inode)->io_tree, start, end,NULL ); -free_extent_map (em); +btrfs_free_extent_map (em);return ret; }
fs/btrfs/scrub.c +1 -1
@@ -3803,7 +3803,7 @@ static noinline_for_stack int scrub_chunk(struct scrub_ctx *sctx, } } out: -free_extent_map (em); +btrfs_free_extent_map (em);return ret; }
fs/btrfs/tests/extent-map-tests.c +26 -26
171 lines not on this page · raw message
fs/btrfs/tests/inode-tests.c +21 -21
168 lines not on this page · raw message
fs/btrfs/tree-log.c +2 -2
@@ -4989,7 +4989,7 @@ static int btrfs_log_changed_extents(struct btrfs_trans_handle *trans,*/ if (ret) {clear_em_logging (tree, em); -free_extent_map (em); +btrfs_free_extent_map (em);continue ; }
@@ -4998,7 +4998,7 @@ static int btrfs_log_changed_extents(struct btrfs_trans_handle *trans, ret =log_one_extent (trans, inode, em, path, ctx);write_lock (&tree->lock);clear_em_logging (tree, em); -free_extent_map (em); +btrfs_free_extent_map (em); }WARN_ON (!list_empty (&extents));write_unlock (&tree->lock);
fs/btrfs/volumes.c +26 -26
182 lines not on this page · raw message
fs/btrfs/zoned.c +3 -3
@@ -1573,7 +1573,7 @@ int btrfs_load_block_group_zone_info(struct btrfs_block_group *cache, bool new) }bitmap_free (active);kfree (zone_info); -free_extent_map (em); +btrfs_free_extent_map (em);return ret; }
@@ -1718,7 +1718,7 @@ void btrfs_rewrite_logical_zoned(struct btrfs_ordered_extent *ordered) em =search_extent_mapping (em_tree, ordered->file_offset, ordered->num_bytes); em->block_start = *logical; -free_extent_map (em); +btrfs_free_extent_map (em);write_unlock (&em_tree->lock);list_for_each_entry (sum, &ordered->list, list) {
@@ -1869,7 +1869,7 @@ struct btrfs_device *btrfs_zoned_get_device(struct btrfs_fs_info *fs_info,/* We only support single profile for now */ device = map->stripes[0 ].dev; -free_extent_map (em); +btrfs_free_extent_map (em);return device; }
Signature · 1 line
2.53.0
Sasha Levin
maintainerPATCH 3/3 btrfs: fix extent map leak in NOCOW direct I/O write
In reply to Sasha LevinFrom: Shuangpeng Bai <[email protected]>
[ Upstream commit 3f950867c307c5413d628a153ac44915bd117ffd ]
btrfs_dio_iomap_begin() calls btrfs_get_extent(), which returns an extent map reference that must be dropped on all exit paths.
For direct writes into a NOCOW range, btrfs_get_blocks_direct_write() keeps using that extent map and asks btrfs_create_dio_extent() to allocate the ordered extent. If that fails, for example because btrfs_alloc_ordered_extent() fails, the function returns the error without dropping the input extent map. The PREALLOC path avoided this by dropping the input extent map before replacing it with the newly created one.
Check the error from btrfs_create_dio_extent() before replacing the map and drop the input extent map on failure.
--- fs/btrfs/inode.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-)
fs/btrfs/inode.c +13 -6
@@ -7690,17 +7690,24 @@ static int btrfs_get_blocks_direct_write(struct extent_map **map, len, orig_block_len, ram_bytes, type);btrfs_dec_nocow_writers (bg); -if (type ==BTRFS_ORDERED_PREALLOC ) { -btrfs_free_extent_map (em); - *map = em2; - em = em2; - } -if (IS_ERR (em2)) { ret =PTR_ERR (em2); +btrfs_free_extent_map (em); + *map =NULL ; goto out; } +/* +* True NOCOW writes don't need to create a new extent map, +* while PREALLOC writes must replace the existing one. +*/ +if (em2) { +ASSERT (type ==BTRFS_ORDERED_PREALLOC ); +btrfs_free_extent_map (em); + *map = em2; + em = em2; + } + dio_data->nocow_done = true; }else {/* Our caller expects us to free the input extent map. */
Signature · 1 line
2.53.0