[BUG] When running fuzz-tests/003 and fuzz-tests/009, btrfs-progs will crash due to BUG_ON().
[CAUSE] We abused BUG_ON() in btrfs_commit_transaction(), which is one of the most error prone function for fuzzed images. Currently to cleanup the aborted transaction, we only need to clean up the only per-transaction data: delayed refs. This patch will introduce a new function, btrfs_destroy_delayed_refs() to cleanup delayed refs when we failed to commit transaction. With that function, we will gently destroy per-trans delayed ref, and remove the BUG_ON()s in btrfs_commit_transaction(). Signed-off-by: Qu Wenruo <[email protected]> --- delayed-ref.c | 24 ++++++++++++++++++++++++ delayed-ref.h | 5 +++++ extent-tree.c | 6 +++--- transaction.c | 20 ++++++++++++++------ 4 files changed, 46 insertions(+), 9 deletions(-) diff --git a/delayed-ref.c b/delayed-ref.c index 9974dbbd4c6b..69f8be34fe18 100644 --- a/delayed-ref.c +++ b/delayed-ref.c @@ -605,3 +605,27 @@ free_ref: return -ENOMEM; } + +void btrfs_destroy_delayed_refs(struct btrfs_trans_handle *trans) +{ + struct btrfs_fs_info *fs_info = trans->fs_info; + struct rb_node *node; + struct btrfs_delayed_ref_root *delayed_refs; + + delayed_refs = &trans->delayed_refs; + if (RB_EMPTY_ROOT(&delayed_refs->href_root)) + return; + while ((node = rb_first(&delayed_refs->href_root)) != NULL) { + struct btrfs_delayed_ref_head *head; + struct btrfs_delayed_ref_node *ref; + struct rb_node *n; + + head = rb_entry(node, struct btrfs_delayed_ref_head, href_node); + while ((n = rb_first(&head->ref_tree)) != NULL) { + ref = rb_entry(n, struct btrfs_delayed_ref_node, + ref_node); + drop_delayed_ref(trans, delayed_refs, head, ref); + } + ASSERT(cleanup_ref_head(trans, fs_info, head) == 0); + } +} diff --git a/delayed-ref.h b/delayed-ref.h index 30a68b2a278c..4ff3eaa929ba 100644 --- a/delayed-ref.h +++ b/delayed-ref.h @@ -205,4 +205,9 @@ btrfs_delayed_node_to_tree_ref(struct btrfs_delayed_ref_node *node) { return container_of(node, struct btrfs_delayed_tree_ref, node); } + +int cleanup_ref_head(struct btrfs_trans_handle *trans, + struct btrfs_fs_info *fs_info, + struct btrfs_delayed_ref_head *head); +void btrfs_destroy_delayed_refs(struct btrfs_trans_handle *trans); #endif diff --git a/extent-tree.c b/extent-tree.c index 1140ebfc61ff..e62ee8c2ba13 100644 --- a/extent-tree.c +++ b/extent-tree.c @@ -4085,9 +4085,9 @@ static void unselect_delayed_ref_head(struct btrfs_delayed_ref_root *delayed_ref delayed_refs->num_heads_ready++; } -static int cleanup_ref_head(struct btrfs_trans_handle *trans, - struct btrfs_fs_info *fs_info, - struct btrfs_delayed_ref_head *head) +int cleanup_ref_head(struct btrfs_trans_handle *trans, + struct btrfs_fs_info *fs_info, + struct btrfs_delayed_ref_head *head) { struct btrfs_delayed_ref_root *delayed_refs; diff --git a/transaction.c b/transaction.c index 8d15eb11c7b5..138e10f0d6cc 100644 --- a/transaction.c +++ b/transaction.c @@ -17,6 +17,7 @@ #include "kerncompat.h" #include "disk-io.h" #include "transaction.h" +#include "delayed-ref.h" #include "messages.h" @@ -165,7 +166,8 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans, * consistent */ ret = btrfs_run_delayed_refs(trans, -1); - BUG_ON(ret); + if (ret < 0) + goto error; if (root->commit_root == root->node) goto commit_tree; @@ -182,21 +184,24 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans, root->root_item.level = btrfs_header_level(root->node); ret = btrfs_update_root(trans, root->fs_info->tree_root, &root->root_key, &root->root_item); - BUG_ON(ret); + if (ret < 0) + goto error; commit_tree: ret = commit_tree_roots(trans, fs_info); - BUG_ON(ret); + if (ret < 0) + goto error; /* * Ensure that all committed roots are properly accounted in the * extent tree */ ret = btrfs_run_delayed_refs(trans, -1); - BUG_ON(ret); + if (ret < 0) + goto error; btrfs_write_dirty_block_groups(trans); __commit_transaction(trans, root); if (ret < 0) - goto out; + goto error; ret = write_ctree_super(trans); btrfs_finish_extent_commit(trans); kfree(trans); @@ -204,7 +209,10 @@ commit_tree: root->commit_root = NULL; fs_info->running_transaction = NULL; fs_info->last_trans_committed = transid; -out: + return ret; +error: + btrfs_destroy_delayed_refs(trans); + free(trans); return ret; } -- 2.21.0
