[PATCH v3] btrfs: fix a crash in the trace event btrfs_sync_file()

[PATCH v3] btrfs: fix a crash in the trace event btrfs_sync_file()

[Goldwyn Rodrigues]

If overlay is used on top of btrfs, dentry->d_sb translates to overlay's
super block and fsid assignment will lead to a crash.

Use file_inode(file)->i_sb to always get btrfs_sb.

Signed-off-by: Goldwyn Rodrigues <rgoldwyn@suse.com>
---
Changes since v2:
- Use of dget_parent() to get the parent of the inode
Changes since v1:
- Changed subject to include trace
- Use file_inode() to get inode pointer

 include/trace/events/btrfs.h | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/include/trace/events/btrfs.h b/include/trace/events/btrfs.h
index 125bdc166bfe..0864700f76e0 100644
--- a/include/trace/events/btrfs.h
+++ b/include/trace/events/btrfs.h
@@ -769,12 +769,15 @@ TRACE_EVENT(btrfs_sync_file,
 	),
 
 	TP_fast_assign(
-		const struct dentry *dentry = file->f_path.dentry;
-		const struct inode *inode = d_inode(dentry);
+		struct dentry *dentry = file_dentry(file);
+		struct inode *inode = file_inode(file);
+		struct dentry *parent = dget_parent(dentry);
+		struct inode *parent_inode = d_inode(parent);
 
-		TP_fast_assign_fsid(btrfs_sb(file->f_path.dentry->d_sb));
+		dput(parent);
+		TP_fast_assign_fsid(btrfs_sb(inode->i_sb));
 		__entry->ino		= btrfs_ino(BTRFS_I(inode));
-		__entry->parent		= btrfs_ino(BTRFS_I(d_inode(dentry->d_parent)));
+		__entry->parent		= btrfs_ino(BTRFS_I(parent_inode));
 		__entry->datasync	= datasync;
 		__entry->root_objectid	= btrfs_root_id(BTRFS_I(inode)->root);
 	),
-- 
2.53.0

Re: [PATCH v3] btrfs: fix a crash in the trace event btrfs_sync_file()

[Boris Burkov]

On Fri, Mar 13, 2026 at 02:11:39PM -0400, Goldwyn Rodrigues wrote:
> If overlay is used on top of btrfs, dentry->d_sb translates to overlay's
> super block and fsid assignment will lead to a crash.
> 
> Use file_inode(file)->i_sb to always get btrfs_sb.
> 

Is there a relevant Fixes: commit here?

> Signed-off-by: Goldwyn Rodrigues <rgoldwyn@suse.com>

Reviewed-by: Boris Burkov <boris@bur.io>

> ---
> Changes since v2:
> - Use of dget_parent() to get the parent of the inode
> Changes since v1:
> - Changed subject to include trace
> - Use file_inode() to get inode pointer
> 
>  include/trace/events/btrfs.h | 11 +++++++----
>  1 file changed, 7 insertions(+), 4 deletions(-)
> 
> diff --git a/include/trace/events/btrfs.h b/include/trace/events/btrfs.h
> index 125bdc166bfe..0864700f76e0 100644
> --- a/include/trace/events/btrfs.h
> +++ b/include/trace/events/btrfs.h
> @@ -769,12 +769,15 @@ TRACE_EVENT(btrfs_sync_file,
>  	),
>  
>  	TP_fast_assign(
> -		const struct dentry *dentry = file->f_path.dentry;
> -		const struct inode *inode = d_inode(dentry);
> +		struct dentry *dentry = file_dentry(file);
> +		struct inode *inode = file_inode(file);
> +		struct dentry *parent = dget_parent(dentry);
> +		struct inode *parent_inode = d_inode(parent);
>  
> -		TP_fast_assign_fsid(btrfs_sb(file->f_path.dentry->d_sb));
> +		dput(parent);
> +		TP_fast_assign_fsid(btrfs_sb(inode->i_sb));
>  		__entry->ino		= btrfs_ino(BTRFS_I(inode));
> -		__entry->parent		= btrfs_ino(BTRFS_I(d_inode(dentry->d_parent)));
> +		__entry->parent		= btrfs_ino(BTRFS_I(parent_inode));
>  		__entry->datasync	= datasync;
>  		__entry->root_objectid	= btrfs_root_id(BTRFS_I(inode)->root);
>  	),
> -- 
> 2.53.0

Re: [PATCH v3] btrfs: fix a crash in the trace event btrfs_sync_file()

[David Sterba]

On Fri, Mar 13, 2026 at 02:11:39PM -0400, Goldwyn Rodrigues wrote:
> If overlay is used on top of btrfs, dentry->d_sb translates to overlay's
> super block and fsid assignment will lead to a crash.
> 
> Use file_inode(file)->i_sb to always get btrfs_sb.
> 
> Signed-off-by: Goldwyn Rodrigues <rgoldwyn@suse.com>
> ---
> Changes since v2:
> - Use of dget_parent() to get the parent of the inode
> Changes since v1:
> - Changed subject to include trace
> - Use file_inode() to get inode pointer

Added to for-next, thanks.