Commit f6f0da56 authored by Johannes Thumshirn's avatar Johannes Thumshirn Committed by David Sterba
Browse files

btrfs: don't BUG_ON() in btrfs_drop_extents() 



btrfs_drop_extents() calls BUG_ON() in case the counter of to be deleted
extents is greater than 0. But all of these code paths can handle errors,
so there's no need to crash the kernel. Instead WARN() that the condition
has been met and gracefully bail out.

Reviewed-by: default avatarFilipe Manana <fdmanana@suse.com>
Reviewed-by: default avatarQu Wenruo <wqu@suse.com>
Signed-off-by: default avatarJohannes Thumshirn <johannes.thumshirn@wdc.com>
Signed-off-by: default avatarDavid Sterba <dsterba@suse.com>
parent 453a73c3

fs/btrfs/file.c

+21 −4
Original line number Diff line number Diff line
@@ -36,6 +36,7 @@ 
#include "ioctl.h"

#include "file.h"

#include "super.h"

#include "print-tree.h"



/*

 * Helper to fault in page and copy.  This should go away and be replaced with
@@ -245,7 +246,11 @@ int btrfs_drop_extents(struct btrfs_trans_handle *trans, 
next_slot:

		leaf = path->nodes[0];

		if (path->slots[0] >= btrfs_header_nritems(leaf)) {

			BUG_ON(del_nr > 0);

			if (WARN_ON(del_nr > 0)) {

				btrfs_print_leaf(leaf);

				ret = -EINVAL;

				break;

			}

			ret = btrfs_next_leaf(root, path);

			if (ret < 0)

				break;
@@ -321,7 +326,11 @@ int btrfs_drop_extents(struct btrfs_trans_handle *trans, 
		 *  | -------- extent -------- |

		 */

		if (args->start > key.offset && args->end < extent_end) {

			BUG_ON(del_nr > 0);

			if (WARN_ON(del_nr > 0)) {

				btrfs_print_leaf(leaf);

				ret = -EINVAL;

				break;

			}

			if (extent_type == BTRFS_FILE_EXTENT_INLINE) {

				ret = -EOPNOTSUPP;

				break;
@@ -409,7 +418,11 @@ int btrfs_drop_extents(struct btrfs_trans_handle *trans, 
		 *  | -------- extent -------- |

		 */

		if (args->start > key.offset && args->end >= extent_end) {

			BUG_ON(del_nr > 0);

			if (WARN_ON(del_nr > 0)) {

				btrfs_print_leaf(leaf);

				ret = -EINVAL;

				break;

			}

			if (extent_type == BTRFS_FILE_EXTENT_INLINE) {

				ret = -EOPNOTSUPP;

				break;
@@ -437,7 +450,11 @@ int btrfs_drop_extents(struct btrfs_trans_handle *trans, 
				del_slot = path->slots[0];

				del_nr = 1;

			} else {

				BUG_ON(del_slot + del_nr != path->slots[0]);

				if (WARN_ON(del_slot + del_nr != path->slots[0])) {

					btrfs_print_leaf(leaf);

					ret = -EINVAL;

					break;

				}

				del_nr++;

			}