[SRU][B][PATCH 1/2] Revert "btrfs: reloc: fix reloc root leak and NULL pointer dereference"

[Matthew Ruffell]

BugLink: https://bugs.launchpad.net/bugs/1933172

This reverts commit 6f536ce7a978531d38a21d092394616cefb54436.

A mistake was made in the backport of "btrfs: reloc: fix reloc root leak and
NULL pointer dereference" to Bionic, and this commit reverts the changes, so we
can fix them in the next commit.

If you attempt to balance a btrfs filesystem where root nodes need to be
relocated, some root nodes were mistakenly freed with calls to
btrfs_put_fs_root(), which leads to a general protection fault when we try to
access those root nodes when we try and commit the balance transaction.

This results in the following stack trace:

general protection fault: 0000 [#1] SMP PTI
CPU: 0 PID: 18440 Comm: btrfs Not tainted 4.15.0-136-generic #140-Ubuntu
RIP: 0010:btrfs_set_root_node+0x5/0x60 [btrfs]
Call Trace:
 ? commit_fs_roots+0x130/0x1b0 [btrfs]
 ? btrfs_run_delayed_refs.part.70+0x80/0x190 [btrfs]
 btrfs_commit_transaction+0x42c/0x910 [btrfs]
 ? start_transaction+0x191/0x430 [btrfs]
 relocate_block_group+0x1e7/0x640 [btrfs]
 btrfs_relocate_block_group+0x18f/0x280 [btrfs]
 btrfs_relocate_chunk+0x38/0xd0 [btrfs]
 __btrfs_balance+0x972/0xcd0 [btrfs]
 ? insert_balance_item.isra.35+0x391/0x3c0 [btrfs]
 btrfs_balance+0x32c/0x5a0 [btrfs]
 btrfs_ioctl_balance+0x320/0x390 [btrfs]
 btrfs_ioctl+0x5a6/0x2490 [btrfs]
 ? lru_cache_add_active_or_unevictable+0x36/0xb0
 ? __handle_mm_fault+0x9fd/0x1290
 do_vfs_ioctl+0xa8/0x630
 ? btrfs_ioctl_get_supported_features+0x30/0x30 [btrfs]
 ? do_vfs_ioctl+0xa8/0x630
 ? __do_page_fault+0x2a1/0x4b0
 SyS_ioctl+0x79/0x90
 do_syscall_64+0x73/0x130
 entry_SYSCALL_64_after_hwframe+0x41/0xa6

Revert the changes, so we can apply the correct backport in the next patch.

Signed-off-by: Matthew Ruffell <matthew.ruffell at canonical.com>
---
 fs/btrfs/relocation.c | 16 +++-------------
 1 file changed, 3 insertions(+), 13 deletions(-)

diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
index b227c4c57cd8..95bc0ee66c03 100644
--- a/fs/btrfs/relocation.c
+++ b/fs/btrfs/relocation.c
@@ -2444,10 +2444,12 @@ void merge_reloc_roots(struct reloc_control *rc)
 		reloc_root = list_entry(reloc_roots.next,
 					struct btrfs_root, root_list);
 
-		root = read_fs_root(fs_info, reloc_root->root_key.offset);
 		if (btrfs_root_refs(&reloc_root->root_item) > 0) {
+			root = read_fs_root(fs_info,
+					    reloc_root->root_key.offset);
 			BUG_ON(IS_ERR(root));
 			BUG_ON(root->reloc_root != reloc_root);
+
 			ret = merge_reloc_root(rc, root);
 			if (ret) {
 				if (list_empty(&reloc_root->root_list))
@@ -2456,18 +2458,6 @@ void merge_reloc_roots(struct reloc_control *rc)
 				goto out;
 			}
 		} else {
-			if (!IS_ERR(root)) {
-				if (root->reloc_root == reloc_root) {
-					root->reloc_root = NULL;
-					free_extent_buffer(root->reloc_root->node);
-					free_extent_buffer(root->reloc_root->commit_root);
-					btrfs_put_fs_root(reloc_root);
-				}
-				free_extent_buffer(root->node);
-				free_extent_buffer(root->commit_root);
-				btrfs_put_fs_root(root);
-			}
-
 			list_del_init(&reloc_root->root_list);
 		}
 
-- 
2.30.2