Re: [PATCH] Btrfs: fix crash regarding to ulist_add_merge

[Liu Bo <bo.li.liu@oracle.com>]

On Wed, Jun 26, 2013 at 07:23:41PM -0700, Zach Brown wrote:
> > > But in the krealloc() case the rb_erase() will be trying to reference
> > > freed memmory because krealloc() frees the old pointer on success.
> > 
> > Yeah, I realize that you're absolutely right, but my box
> > didn't complain about the abused old pointers when we're not in int_nodes
> > case, which is weird...
> 
> The freed space probably just hasn't been reused yet.  Have you tried
> with CONFIG_DEBUG_PAGEALLOC or CONFIG_DEBUG_SLAB?
> 
> > > Yeah, it's insane, but no more so than using krealloc() for an array
> > > with internal pointers in the first place.
> > 
> > I doubt if it can work, I'd prefer the re-insert dance.
> 
> It should, but it is a disgusting hack.  Not worth it if you can't get
> it going.
> 
> Re-initializing the nodes instead of removing them after they're moved
> should work.
> 
> But really, this is all bonkers.  A ulist implementation that doesn't
> require this fixup would be better.  Maybe lose the array and have a
> simple list_head and slab of allocated structs.  Reliable first,
> performant second, presuming there's data to justify it.

I agree, I'm trying to work it out and will test it with DEBUG_PAGEALLOC ;)

thanks,
liubo