tree 870724f193b99f9388dce8e7cbdfcb96b3cfeed5
parent ae6529c35bcc1c65c12131cef2aea63d8e2ea950
author Qu Wenruo <quwenruo@cn.fujitsu.com> 1490751202 +0800
committer David Sterba <dsterba@suse.com> 1492517246 +0200

btrfs: Prevent scrub recheck from racing with dev replace

scrub_setup_recheck_block() calls btrfs_map_sblock() and then accesses
bbio without protection of bio_counter.

This can lead to use-after-free if racing with dev replace cancel.

Fix it by increasing bio_counter before calling btrfs_map_sblock() and
decreasing the bio_counter when corresponding recover is finished.

Cc: Liu Bo <bo.li.liu@oracle.com>
Reported-by: Liu Bo <bo.li.liu@oracle.com>
Signed-off-by: Qu Wenruo <quwenruo@cn.fujitsu.com>
Signed-off-by: David Sterba <dsterba@suse.com>