Liu Bo 14c7cca780 Btrfs: fix an oops when deleting snapshots
We can reproduce this oops via the following steps:

$ mkfs.btrfs /dev/sdb7
$ mount /dev/sdb7 /mnt/btrfs
$ for ((i=0; i<3; i++)); do btrfs sub snap /mnt/btrfs /mnt/btrfs/s_$i; done
$ rm -fr /mnt/btrfs/*
$ rm -fr /mnt/btrfs/*

then we'll get
------------[ cut here ]------------
kernel BUG at fs/btrfs/inode.c:2264!
[...]
Call Trace:
 [<ffffffffa05578c7>] btrfs_rmdir+0xf7/0x1b0 [btrfs]
 [<ffffffff81150b95>] vfs_rmdir+0xa5/0xf0
 [<ffffffff81153cc3>] do_rmdir+0x123/0x140
 [<ffffffff81145ac7>] ? fput+0x197/0x260
 [<ffffffff810aecff>] ? audit_syscall_entry+0x1bf/0x1f0
 [<ffffffff81153d0d>] sys_unlinkat+0x2d/0x40
 [<ffffffff8147896b>] system_call_fastpath+0x16/0x1b
RIP  [<ffffffffa054f7b9>] btrfs_orphan_add+0x179/0x1a0 [btrfs]

When it comes to btrfs_lookup_dentry, we may set a snapshot's inode->i_ino
to BTRFS_EMPTY_SUBVOL_DIR_OBJECTID instead of BTRFS_FIRST_FREE_OBJECTID,
while the snapshot's location.objectid remains unchanged.

However, btrfs_ino() does not take this into account, and returns a wrong ino,
and causes the oops.

Signed-off-by: Liu Bo <liubo2009@cn.fujitsu.com>
Signed-off-by: Chris Mason <chris.mason@oracle.com>
2011-09-11 10:52:24 -04:00
..
2011-03-31 11:26:23 -03:00
2011-03-31 11:26:23 -03:00
2011-03-31 11:26:23 -03:00
2011-05-19 16:55:28 +09:30
2011-03-10 08:52:07 +01:00
2011-07-17 23:20:29 -04:00
2011-06-06 09:51:52 -04:00
2011-06-03 18:24:58 -04:00
2011-06-20 17:53:24 -05:00
2011-03-31 11:26:23 -03:00
2011-03-31 11:26:23 -03:00
2011-06-03 18:24:58 -04:00
2011-01-07 17:50:26 +11:00
2011-03-10 08:52:07 +01:00
2011-04-14 16:06:56 -07:00
2011-07-17 23:21:35 -04:00
2011-07-06 12:15:16 -07:00
2010-10-29 04:16:28 -04:00
2011-03-31 11:26:23 -03:00
2011-03-21 00:16:08 -04:00
2011-07-06 10:41:13 -07:00
2011-05-26 10:01:43 -06:00
2011-03-21 01:10:41 -04:00
2011-01-07 17:50:33 +11:00
2011-05-23 19:58:53 +02:00
2011-03-14 09:15:28 -04:00
2011-06-03 18:24:58 -04:00