[PATCH] btrfs: don't add delayed refs to an aborted transaction

[Adarsh Das]

When a transaction aborts, cleanup_transaction() calls
btrfs_cleanup_one_transaction() which drains all pending delayed refs
via btrfs_destroy_delayed_refs().

But, btrfs_cleanup_one_transaction() then wakes up tasks waiting
on transaction_blocked_wait and sets the transaction state to
TRANS_STATE_UNBLOCKED. These woken tasks can then call btrfs_add_delayed_tree_ref(),
btrfs_add_delayed_data_ref(), or btrfs_add_delayed_extent_op() on the
already-aborted transaction, inserting new entries into the head_refs
xarray after it was just drained.

When btrfs_put_transaction() subsequently drops the refcount to zero, it
hits:

  WARN_ON(!xa_empty(&transaction->delayed_refs.head_refs));

This patch fixes this by checking TRANS_ABORTED() at the start of add_delayed_ref()
and btrfs_add_delayed_extent_op() before inserting into the xarray.
btrfs_abort_transaction() is called at the start of cleanup_transaction(),
before btrfs_destroy_delayed_refs(), so the aborted flag should always be set
before any wakeups occur.

Reported-by: syzbot+6d30e046bbd449d3f6f1@xxxxxxxxxxxxxxxxxxxxxxxxx
Signed-off-by: Adarsh Das <adarshdas950@xxxxxxxxx>
---
 fs/btrfs/delayed-ref.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/fs/btrfs/delayed-ref.c b/fs/btrfs/delayed-ref.c
index 3766ff29fbbb..b994f9702c32 100644
--- a/fs/btrfs/delayed-ref.c
+++ b/fs/btrfs/delayed-ref.c
@@ -327,7 +327,7 @@ static int cmp_refs_node(const struct rb_node *new, const struct rb_node *exist)
 	return comp_refs(new_node, exist_node, true);
 }
 
-static struct btrfs_delayed_ref_node* tree_insert(struct rb_root_cached *root,
+static struct btrfs_delayed_ref_node *tree_insert(struct rb_root_cached *root,
 		struct btrfs_delayed_ref_node *ins)
 {
 	struct rb_node *node = &ins->ref_node;
@@ -1025,6 +1025,10 @@ static int add_delayed_ref(struct btrfs_trans_handle *trans,
 	}
 
 	delayed_refs = &trans->transaction->delayed_refs;
+	if (TRANS_ABORTED(trans->transaction)) {
+		ret = -EIO;
+		goto free_head_ref;
+	}
 
 	if (btrfs_qgroup_full_accounting(fs_info) && !generic_ref->skip_qgroup) {
 		record = kzalloc_obj(*record, GFP_NOFS);
@@ -1153,6 +1157,10 @@ int btrfs_add_delayed_extent_op(struct btrfs_trans_handle *trans,
 	head_ref->extent_op = extent_op;
 
 	delayed_refs = &trans->transaction->delayed_refs;
+	if (TRANS_ABORTED(trans->transaction)) {
+		kmem_cache_free(btrfs_delayed_ref_head_cachep, head_ref);
+		return -EIO;
+	}
 
 	ret = xa_reserve(&delayed_refs->head_refs, index, GFP_NOFS);
 	if (ret) {
-- 
2.53.0