Re: [PATCH v3] Btrfs: fix crash regarding to ulist_add_merge

[Liu Bo <bo.li.liu@oracle.com>]

On Fri, Jun 28, 2013 at 12:43:14PM -0700, Zach Brown wrote:
> On Fri, Jun 28, 2013 at 12:37:45PM +0800, Liu Bo wrote:
> > Several users reported this crash of NULL pointer or general protection,
> > the story is that we add a rbtree for speedup ulist iteration, and we
> > use krealloc() to address ulist growth, and krealloc() use memcpy to copy
> > old data to new memory area, so it's OK for an array as it doesn't use
> > pointers while it's not OK for a rbtree as it uses pointers.
> > 
> > So krealloc() will mess up our rbtree and it ends up with crash.
> > 
> > Reviewed-by: Wang Shilong <wangsl-fnst@cn.fujitsu.com>
> > Signed-off-by: Liu Bo <bo.li.liu@oracle.com>
> 
> Yeah, this should fix the probem.  Thanks for being persistent.
> 
> Reviewed-by: Zach Brown <zab@redhat.com>
> 
> > +		for (i = 0; i < ulist->nnodes; i++)
> > +			rb_erase(&ulist->nodes[i].rb_node, &ulist->root);
> 
> (still twitching over here because this is a bunch of work that achieves
> nothing :))

Hmm, I think that this is necessary for the inline array inside ulist,
so I keep it :)

- liubo