• Filipe Manana's avatar
    Btrfs: fix inode eviction infinite loop after extent_same ioctl · ac52f6f5
    Filipe Manana authored
    commit 113e8283 upstream.
    
    If we pass a length of 0 to the extent_same ioctl, we end up locking an
    extent range with a start offset greater then its end offset (if the
    destination file's offset is greater than zero). This results in a warning
    from extent_io.c:insert_state through the following call chain:
    
      btrfs_extent_same()
        btrfs_double_lock()
          lock_extent_range()
            lock_extent(inode->io_tree, offset, offset + len - 1)
              lock_extent_bits()
                __set_extent_bit()
                  insert_state()
                    --> WARN_ON(end < start)
    
    This leads to an infinite loop when evicting the inode. This is the same
    problem that my previous patch titled
    "Btrfs: fix inode eviction infinite loop after cloning into it" addressed
    but for the extent_same ioctl instead of the clone ioctl.
    Signed-off-by: default avatarFilipe Manana <fdmanana@suse.com>
    Reviewed-by: default avatarOmar Sandoval <osandov@osandov.com>
    Signed-off-by: default avatarChris Mason <clm@fb.com>
    Signed-off-by: default avatarLuis Henriques <luis.henriques@canonical.com>
    ac52f6f5
ioctl.c 130 KB