Re: [PATCH] btrfs: fix use after free iterating extrefs

[Chris Mason <clm@fb.com>]

On Tue, Oct 13, 2015 at 12:17:55PM -0700, Mark Fasheh wrote:
> On Tue, Oct 13, 2015 at 02:06:48PM -0400, Chris Mason wrote:
> > The code for btrfs inode-resolve has never worked properly for
> > files with enough hard links to trigger extrefs.  It was trying to
> > get the leaf out of a path after freeing the path:
> > 
> > 	btrfs_release_path(path);
> > 	leaf = path->nodes[0];
> > 	item_size = btrfs_item_size_nr(leaf, slot);
> > 
> > The fix here is to use the extent buffer we cloned just a little higher
> > up to avoid deadlocks caused by using the leaf in the path.
> > 
> > Signed-off-by: Chris Mason <clm@fb.com>
> > cc: stable@vger.kernel.org # v3.7+
> > cc: Mark Fasheh <mfasheh@suse.de>
> Reviewed-by: Mark Fasheh <mfasheh@suse.de>

Thanks Mark and Filipe, I've tested this and queued it up.

-chris