Re: [PATCH 1/6] Btrfs: fix invalid block group rbtree access after bg is removed

[Josef Bacik <jbacik@fb.com>]

On 11/26/2014 10:28 AM, Filipe Manana wrote:
> If we grab a block group, for example in btrfs_trim_fs(), we will be holding
> a reference on it but the block group can be removed after we got it (via
> btrfs_remove_block_group), which means it will no longer be part of the
> rbtree.
>
> However, btrfs_remove_block_group() was only calling rb_erase() which leaves
> the block group's rb_node left and right child pointers with the same content
> they had before calling rb_erase. This was dangerous because a call to
> next_block_group() would access the node's left and right child pointers (via
> rb_next), which can be no longer valid.
>
> Fix this by clearing a block group's node after removing it from the tree,
> and have next_block_group() do a tree search to get the next block group
> instead of using rb_next() if our block group was removed.
>
> Signed-off-by: Filipe Manana <fdmanana@suse.com>

Reviewed-by: Josef Bacik <jbacik@fb.com>

Josef